Adding Support to Properly Escape Objects that have __toString() magic method so that the object can be passed directly as a parameter in a condition without having to manually convert to a string
Signed-off-by: Joel Kallman <jkallman@eclarian.com>
diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php
index 9d92f2f..a72bf31 100644
--- a/system/database/DB_driver.php
+++ b/system/database/DB_driver.php
@@ -727,7 +727,7 @@
*/
function escape($str)
{
- if (is_string($str))
+ if (is_string($str) OR method_exists($str, '__toString'))
{
$str = "'".$this->escape_str($str)."'";
}