Escape WHERE clause field names in the DB update_string() method
diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php
index 300ca29..12c0530 100644
--- a/system/database/DB_driver.php
+++ b/system/database/DB_driver.php
@@ -950,6 +950,7 @@
foreach ($where as $key => $val)
{
$prefix = (count($dest) == 0) ? '' : ' AND ';
+ $key = $this->_protect_identifiers($key);
if ($val !== '')
{
@@ -1390,4 +1391,4 @@
/* End of file DB_driver.php */
-/* Location: ./system/database/DB_driver.php */
\ No newline at end of file
+/* Location: ./system/database/DB_driver.php */