From a779c48da5643ea710da7fc0941a80629a196acf Mon Sep 17 00:00:00 2001 From: clawoo Date: Sat, 18 Oct 2014 14:47:04 +0300 Subject: Escape arrays sent as binding values for database queries. --- system/database/DB_driver.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'system/database') diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php index 62cea758e..094356965 100644 --- a/system/database/DB_driver.php +++ b/system/database/DB_driver.php @@ -992,7 +992,12 @@ abstract class CI_DB_driver { */ public function escape($str) { - if (is_string($str) OR (is_object($str) && method_exists($str, '__toString'))) + if (is_array($str)) + { + $str = array_map(array(&$this, 'escape'), $str); + return '('.implode(',', $str).')'; + } + elseif (is_string($str) OR (is_object($str) && method_exists($str, '__toString'))) { return "'".$this->escape_str($str)."'"; } -- cgit v1.2.3-24-g4f1b From 4a4f5509832412aff3a6fb571d8be2454733e98b Mon Sep 17 00:00:00 2001 From: clawoo Date: Mon, 20 Oct 2014 15:28:08 +0300 Subject: Escape the array elements separately and join them in compile_binds() --- system/database/DB_driver.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'system/database') diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php index 094356965..fc1d9566c 100644 --- a/system/database/DB_driver.php +++ b/system/database/DB_driver.php @@ -922,7 +922,12 @@ abstract class CI_DB_driver { do { $c--; - $sql = substr_replace($sql, $this->escape($binds[$c]), $matches[0][$c][1], $ml); + $escaped_value = $this->escape($binds[$c]); + if (is_array($escaped_value)) + { + $escaped_value = '('.implode(',', $escaped_value).')'; + } + $sql = substr_replace($sql, $escaped_value, $matches[0][$c][1], $ml); } while ($c !== 0); @@ -995,7 +1000,7 @@ abstract class CI_DB_driver { if (is_array($str)) { $str = array_map(array(&$this, 'escape'), $str); - return '('.implode(',', $str).')'; + return $str; } elseif (is_string($str) OR (is_object($str) && method_exists($str, '__toString'))) { -- cgit v1.2.3-24-g4f1b