Escape arrays sent as binding values for database queries.
diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php
index 62cea75..0943569 100644
--- a/system/database/DB_driver.php
+++ b/system/database/DB_driver.php
@@ -992,7 +992,12 @@
*/
public function escape($str)
{
- if (is_string($str) OR (is_object($str) && method_exists($str, '__toString')))
+ if (is_array($str))
+ {
+ $str = array_map(array(&$this, 'escape'), $str);
+ return '('.implode(',', $str).')';
+ }
+ elseif (is_string($str) OR (is_object($str) && method_exists($str, '__toString')))
{
return "'".$this->escape_str($str)."'";
}