Question

Does $this-db->query() have mysql injection protection? I was wondering because I use this in instances and have not done anything to protect against sql injection.

Answer 1

The ActiveRecord style of querying with CodeIgniter escapes parameters, but not query().

You can use active record in this manner:

$someAge = 25;
$this->db->select('names, age');
$query = $this->db->get_where('people', array('age' => '>' . $someAge));

Read more about it here: https://www.codeigniter.com/userguide2/database/active_record.html