Question

here is the URI: example.com/index.php/products/shoes/sandals/123 and here is the corresponding controller:

<?php
class Products extends CI_Controller {

    public function shoes($sandals, $id)
    {
        $this->some_DB_using_Model->getListUsing($sandals,$id)
    }
}
?> 

is it safe to send $sandals directly to the model, or should I apply a filter before sending it.

edit:

function getListUsing($p1,$p2){
     $this->db->start_cache();
     $this->db->select('a');
     $this->db->select('b');
     $this->db->select('c');
     $this->db->where('p1',$p1);
     $this->db->where('p2',$p2);
     //then return the result
}

Answer 1

It depends what the model is doing. If you’re using that in a database query, then, yes you need to escape it.

If you’re using CodeIgniter’s active queries, it will escape stuff for you.