Fix an internal bug in QB where() escaping
This is not a supported use case, but if QB escaping is force-disabled,
string values passed to where() or having() aren't escaped. That's wrong
because escape-disabling should only be possible for identifiers and not
values.
Reported via the forums: http://forum.codeigniter.com/thread-62478.html
diff --git a/system/database/DB_query_builder.php b/system/database/DB_query_builder.php
index a8b5b35..8d21c5a 100644
--- a/system/database/DB_query_builder.php
+++ b/system/database/DB_query_builder.php
@@ -657,10 +657,7 @@
if ($v !== NULL)
{
- if ($escape === TRUE)
- {
- $v = ' '.$this->escape($v);
- }
+ $v = ' '.$this->escape($v);
if ( ! $this->_has_operator($k))
{