I have been looking for a similar bug, but I don’t find it, so I decide to write a new one.
When I try to escape a string using escape_str function, I get incorrect results.
For example:
$query = $this->db->query('insert into table values (?, ?)', array('value1', 'value2 /\/\/\'));
The query result is:
insert into table values ('value1', 'value2 /\/\/\')
The error is in the last slash & quote.
The escape_str function is this:
function escape_str($str)
{
// Escape single quotes
return str_replace("'", "''", $str);
}
Why do you do this way if exists the function mysql_escape_string?
Thanks for your time and sorry for my english