blob: 013d64f33d1c3896f89d883048cc852f3d9c0052 [file] [log] [blame]
adminfb28bb82006-09-24 17:59:33 +00001<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html>
3<head>
4
Derek Allardd2df9bc2007-04-15 17:41:17 +00005<title>CodeIgniter User Guide</title>
adminfb28bb82006-09-24 17:59:33 +00006
7<style type='text/css' media='all'>@import url('../userguide.css');</style>
8<link rel='stylesheet' type='text/css' media='all' href='../userguide.css' />
9
admin17a890d2006-09-27 20:42:42 +000010<script type="text/javascript" src="../nav/nav.js"></script>
admin2296fc32006-09-27 21:07:02 +000011<script type="text/javascript" src="../nav/prototype.lite.js"></script>
admin17a890d2006-09-27 20:42:42 +000012<script type="text/javascript" src="../nav/moo.fx.js"></script>
adminfb28bb82006-09-24 17:59:33 +000013<script type="text/javascript">
14window.onload = function() {
admine334c472006-10-21 19:44:22 +000015 myHeight = new fx.Height('nav', {duration: 400});
adminfb28bb82006-09-24 17:59:33 +000016 myHeight.hide();
17}
18</script>
19
20<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21<meta http-equiv='expires' content='-1' />
22<meta http-equiv= 'pragma' content='no-cache' />
23<meta name='robots' content='all' />
24<meta name='author' content='Rick Ellis' />
Derek Allardd2df9bc2007-04-15 17:41:17 +000025<meta name='description' content='CodeIgniter User Guide' />
adminfb28bb82006-09-24 17:59:33 +000026
27</head>
28<body>
29
30<!-- START NAVIGATION -->
31<div id="nav"><div id="nav_inner"><script type="text/javascript">create_menu('../');</script></div></div>
32<div id="nav2"><a name="top"></a><a href="javascript:void(0);" onclick="myHeight.toggle();"><img src="../images/nav_toggle.jpg" width="153" height="44" border="0" title="Toggle Table of Contents" alt="Toggle Table of Contents" /></a></div>
33<div id="masthead">
34<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
35<tr>
Derek Allardd2df9bc2007-04-15 17:41:17 +000036<td><h1>CodeIgniter User Guide Version 1.5.3</h1></td>
adminc0d5d522006-10-30 19:40:35 +000037<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
adminfb28bb82006-09-24 17:59:33 +000038</tr>
39</table>
40</div>
41<!-- END NAVIGATION -->
42
43
44<!-- START BREADCRUMB -->
45<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
46<tr>
47<td id="breadcrumb">
Derek Allardd2df9bc2007-04-15 17:41:17 +000048<a href="http://www.codeigniter.com/">CodeIgniter Home</a> &nbsp;&#8250;&nbsp;
adminfb28bb82006-09-24 17:59:33 +000049<a href="../index.html">User Guide Home</a> &nbsp;&#8250;&nbsp;
50<a href="index.html">Database Library</a> &nbsp;&#8250;&nbsp;
51Queries
52</td>
Derek Allardbc030912007-06-24 18:25:29 +000053<td id="searchbox"><form method="get" action="http://www.google.com/search"><input type="hidden" name="as_sitesearch" id="as_sitesearch" value="codeigniter.com/user_guide/" />Search User Guide&nbsp; <input type="text" class="input" style="width:200px;" name="q" id="q" size="31" maxlength="255" value="" />&nbsp;<input type="submit" class="submit" name="sa" value="Go" /></form></td>
adminfb28bb82006-09-24 17:59:33 +000054</tr>
55</table>
56<!-- END BREADCRUMB -->
57
58
59
60<br clear="all" />
61
62
63<!-- START CONTENT -->
64<div id="content">
65
66
67<h1>Queries</h1>
68
69<h2>$this->db->query();</h2>
70
71<p>To submit a query, use the following function:</p>
72
73<code>$this->db->query('YOUR QUERY HERE');</code>
74
75<p>The <dfn>query()</dfn> function returns a database result <strong>object</strong> when "read" type queries are run,
76which you can use to <a href="results.html">show your results</a>. When "write" type queries are run it simply returns TRUE or FALSE
77depending on success or failure. When retrieving data you will typically assign the query to your own variable, like this:</p>
78
79<code><var>$query</var> = $this->db->query('YOUR QUERY HERE');</code>
80
81<h2>$this->db->simple_query();</h2>
82
83<p>This is a simplified version of the <dfn>$this->db->query()</dfn> function. It ONLY returns TRUE/FALSE on success or failure.
admine334c472006-10-21 19:44:22 +000084It DOES NOT return a database result set, nor does it set the query timer, or compile bind data, or store your query for debugging.
adminfb28bb82006-09-24 17:59:33 +000085It simply lets you submit a query. Most users will rarely use this function.</p>
86
87
admin78ce3cc2006-10-02 02:58:03 +000088<h1>Escaping Queries</h1>
adminfb28bb82006-09-24 17:59:33 +000089
admine334c472006-10-21 19:44:22 +000090<p>It's a very good security practice to escape your data before submitting it into your database.
Derek Allardd2df9bc2007-04-15 17:41:17 +000091CodeIgniter has two functions that help you do this:</p>
adminfb28bb82006-09-24 17:59:33 +000092
93<ol>
94</li>
admine334c472006-10-21 19:44:22 +000095<li><strong>$this->db->escape()</strong> This function determines the data type so that it
adminfb28bb82006-09-24 17:59:33 +000096can escape only string data. It also automatically adds single quotes around the data so you don't have to:
97
Derek Allardc6441282007-07-04 23:54:32 +000098<code>$sql = "INSERT INTO table (title) VALUES(".$this->db->escape($title).")";</code></li>
adminfb28bb82006-09-24 17:59:33 +000099
100
admine334c472006-10-21 19:44:22 +0000101<li><strong>$this->db->escape_str()</strong> This function escapes the data passed to it, regardless of type.
adminfb28bb82006-09-24 17:59:33 +0000102Most of the time you'll use the above function rather then this one. Use the function like this:
103
Derek Allardc6441282007-07-04 23:54:32 +0000104<code>$sql = "INSERT INTO table (title) VALUES('".$this->db->escape_str($title)."')";</code></li>
adminfb28bb82006-09-24 17:59:33 +0000105</ol>
106
107
admin78ce3cc2006-10-02 02:58:03 +0000108<h1>Query Bindings</h1>
adminfb28bb82006-09-24 17:59:33 +0000109
110
111<p>Bindings enable you to simplify your query syntax by letting the system put the queries together for you. Consider the following example:</p>
112
113<code>
114$sql = "SELECT * FROM some_table WHERE id = <var>?</var> AND status = <var>?</var> AND author = <var>?</var>";
115<br /><br />
116$this->db->query($sql, array(3, 'live', 'Rick'));
117</code>
118
119<p>The question marks in the query are automatically replaced with the values in the array in the second parameter of the query function.</p>
120<p class="important">The secondary benefit of using binds is that the values are automatically escaped, producing safer queries. You don't have to remember to manually escape data; the engine does it automatically for you.</p>
121
122
123
124</div>
125<!-- END CONTENT -->
126
127
128<div id="footer">
129<p>
130Previous Topic:&nbsp;&nbsp;<a href="connecting.html">Connecting to your Database</a>
131&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
132<a href="#top">Top of Page</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
133<a href="../index.html">User Guide Home</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
134Next Topic:&nbsp;&nbsp;<a href="results.html">Query Results</a>
Derek Allardc6441282007-07-04 23:54:32 +0000135</p>
Derek Allardd2df9bc2007-04-15 17:41:17 +0000136<p><a href="http://www.codeigniter.com">CodeIgniter</a> &nbsp;&middot;&nbsp; Copyright &#169; 2007 &nbsp;&middot;&nbsp; <a href="http://ellislab.com/">Ellislab, Inc.</a></p>
adminfb28bb82006-09-24 17:59:33 +0000137</div>
138
139</body>
140</html>