From e334c472fb4be44feec3a73402fc4a2b062cbfc0 Mon Sep 17 00:00:00 2001 From: admin Date: Sat, 21 Oct 2006 19:44:22 +0000 Subject: --- user_guide/database/queries.html | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'user_guide/database/queries.html') diff --git a/user_guide/database/queries.html b/user_guide/database/queries.html index a13e2d6a5..e558e3d8b 100644 --- a/user_guide/database/queries.html +++ b/user_guide/database/queries.html @@ -12,7 +12,7 @@ @@ -81,24 +81,24 @@ depending on success or failure. When retrieving data you will typically assign

$this->db->simple_query();

This is a simplified version of the $this->db->query() function. It ONLY returns TRUE/FALSE on success or failure. -It DOES NOT return a database result set, nor does it set the query timer, or compile bind data, or store your query for debugging. +It DOES NOT return a database result set, nor does it set the query timer, or compile bind data, or store your query for debugging. It simply lets you submit a query. Most users will rarely use this function.

Escaping Queries

-

It's a very good security practice to escape your data before submitting it into your database. +

It's a very good security practice to escape your data before submitting it into your database. Code Igniter has two functions that help you do this:

    -
  1. $this->db->escape() This function determines the data type so that it +
  2. $this->db->escape() This function determines the data type so that it can escape only string data. It also automatically adds single quotes around the data so you don't have to: $sql = "INSERT INTO table (title) VALUES(".$this->db->escape($title).")"; -
  3. $this->db->escape_str() This function escapes the data passed to it, regardless of type. +
  4. $this->db->escape_str() This function escapes the data passed to it, regardless of type. Most of the time you'll use the above function rather then this one. Use the function like this: $sql = "INSERT INTO table (title) VALUES('".$this->db->escape_str($title)."')"; -- cgit v1.2.3-24-g4f1b