CODEWITHSUNDEEP
phpcodeigniteractiverecord
beNerd
beNerd

Reputation: 3374

Using slashes in the where clause while comparing values in active record codeigniter

I have the following query

$query="DELETE FROM salesinvoiceitems WHERE invoiceNumber=".$this->put('invoiceNumber');

Here $this->put('invoiceNumber'); always have values like "M\34\SD". Due to slashes in values it doesn't work as expected.

I researched and found the mysql_escape_string can be used for this purpose but its deprecated now as per the manual. So whats my best bet here?

Upvotes: 0

Views: 276

Answers (4)

m4t1t0
m4t1t0

Reputation: 5731

Why not use Codeingiter Active Record instead? An example:

$this->db->where('invoiceNumber', $this->put('invoiceNumber'));
$this->db->delete('salesinvoiceitems');

Taken from Codeigniter documentation:

Beyond simplicity, a major benefit to using the Active Record features is that it allows you to create database independent applications, since the query syntax is generated by each database adapter. It also allows for safer queries, since the values are escaped automatically by the system.

Upvotes: 1

William Buttlicker
William Buttlicker

Reputation: 6000

Try strip slashes

$query="DELETE FROM salesinvoiceitems WHERE invoiceNumber='".($this->put('invoiceNumber')). "'";

Upvotes: 0

Nirmal Ram
Nirmal Ram

Reputation: 1732

Try this

$query="DELETE FROM salesinvoiceitems WHERE invoiceNumber=".addslashes($this->put('invoiceNumber'));

Upvotes: 0

eric.itzhak
eric.itzhak

Reputation: 16072

There's a method in the activerecord called escape, so you should :

$invoice = $this->db->escape($yourVar);
$query = "DELETE FROM salesinvoiceitems WHERE invoiceNumber=$invoice";

Which will protect against sql injection as it escapes the var.

Upvotes: 0

Related Questions