Codeigniter 从数组中增加数据库中的值，仅转义一个组件

Question

I need to increase the value of a field in my CodeIgniter database.

I understand that CI allows not to escape values, setting as FALSE the third parameter in $this->db->set().

I am inserting multiple data from an array, and as I understand, it would be not much secure to escape them all (data is coming from form), since I only need increasing in one field.

How can I avoid inserting this value separately?

My current code:

$dataCliente = array(
    'nombre'          => $nombre,
    'email'           => $email,
    'genero'          => $genero,
    'reserva_next'    => $fecha,
    'reserva_next_id' => $reserva_id,
    'reserva_lastreq' => time(),
    'reservas'        => "reservas+1"
);
$this->db->where('telefono', $telefono);
$this->db->update('clientes', $dataCliente);

EDIT: I HAVE TESTED WITH SIMPLE AND DOUBLE QUOTES, IN BOTH CASES THE VALUE OF THE FIELD IS SAVED AS 0 (ZERO)

The previous code does not produce the expected result. But this works:

$dataCliente = array(
    'nombre'          => $nombre,
    'email'           => $email,
    'genero'          => $genero,
    'reserva_next'    => $fecha,
    'reserva_next_id' => $reserva_id,
    'reserva_lastreq' => time(),
    //'reservas'        => "reservas+1"
);
$this->db->where('telefono', $telefono);
$this->db->update('clientes', $dataCliente);


$this->db->set('reservas', 'reservas+1', FALSE);
$this->db->where('telefono', $telefono);
$this->db->update('clientes', $dataCliente);

My intention is to use only one statement to insert data. Is it possible not to escape a single element of the array, using the first code?

Thank you very much!

Answer 1

The simple answer is No. It's a very simple array.

You can see that the SET statement has 3 parameters. How are you planning on adding that into your data array.

The other reasons probably are...

1. It's already covered by using set with false.
2. It's a royal pain in the butt to add more fields in the array and have to parse them to determine which one requires the false flag.

Using Set as you have is perfectly acceptable and when you think about it in your case...

Each time you perform an update to an entry you will always increment the "reservas" value. This isn't and definitely should not be a part of your "Data" you wish to update from your Form. It is a function of the update itself.

So that kind of leads into... lets make a function. This isn't really part of the answer to your question but I have added it as simply something to ponder over.

You can put this where ever you like but to keep it simple I'll assume you have a client controller and I'll put it all in there for this example...

So set up your $telefono and $dataCliente as only you know where that comes from... Then create a simple single function.

private function update_client_details($data, $telefono) {
    $this->db->set('reservas', 'reservas+1', FALSE);
    $this->db->where('telefono', $telefono);
    $this->db->update('clientes', $data);
}

And call the above method to perform the update. It's become One Statement.

It's a good idea to make this private if its in the controller. In a Model it would need to be public.

Answer 2

use a single quote not double quote

$dataCliente = array(
    'nombre'          => $nombre,
    'email'           => $email,
    'genero'          => $genero,
    'reserva_next'    => $fecha,
    'reserva_next_id' => $reserva_id,
    'reserva_lastreq' => time(),
    'reservas'        => 'reservas+1'
);

see this link for further info