Search code examples
phpmysqlcodeignitersanitization

Safety/vulnerability of using Codeigniter query builder custom where string


I'm working on a Codeigniter 2 project that is just not feasible to upgrade to v.3. So far I've run into a dilemma when using query builder, especially when I need to make a more complex query. CI v.3 handles it quite nicely by using ->group_start() and ->group_end(), but CI v.2 doesn't have it. Now, my dilemma is the following: Is it safe to just use custom where query?

$this->db->where("name='$name' AND status='boss' OR status='active'");

Does the query builder sanitize it enough or should I employ additional sanitization (the third parameter is left as default - true)?

** UPDATE **

I did not write precisely which complex query I need this for. Somewhere along this logic:

A=1 && B=2 && C=3 && (D=10 || E=20 || F=30)


Solution

  • a correct implementation of your query would be

    $this->db
        ->where('name',$name)
        ->group_start()
            ->where('status','boss')
            ->or_where('status','active')
        ->group_end();
    

    edit for Codeigniter 2

    $this->db
        ->where('name',$name)
        ->where('(status','boss')
        ->or_where('status',$this->db->escape('active').')',false);