Backslashes being escaped in where conditions.

[daylightstudio]

I have a scenario where I'm saving a value that contains a backslash "\". The value gets saved as intended without any additional escaping of backslashes. However, if I go to retrieve that same value with a where condition that includes the "\", the "\" gets escaped with "\\" and the where condition doesn't match and there is no way of turning that off so that value can be matched. A workaround is to simply do a raw query but I could see this potentially causing others problems. The reason is because of Mysqli::real_escape_string method is escaping "\" with an additional "\" which is being called from Query::matchNamedBinds (line 409).

Side note (and I realize I'm cramming 2 issues into one and should probably do a pull request... but this is minor), this is missing from the Model class at the top.

use CodeIgniter\Database\Exceptions\DatabaseException;

[lonnieezell]

How did you save your initial value? It's strange to me that it didn't get escaped, since everything should get escaped unless you build your own query or explicitly tell it not to.

[daylightstudio]

It's using the Model::save() method and passing it an array of data. Try it using a value like:

\Admin\User\UserEntity

In tracking the save method through to the MySQLi::execute() method, I'm not seeing where the escape method is being called on the values.

[lonnieezell]

I'm not seeing any issue here. This is what I did to test locally:

new UserModel:

<?php namespace App;

use CodeIgniter\Model;

class UserModel extends Model
{
	protected $table = 'user';

	protected $allowedFields = ['name', 'email', 'country'];
}

new User entity:

<?php namespace App;

use CodeIgniter\Entity;

class User extends Entity
{
	protected $name;
	protected $email;
	protected $country;
}

Ran the following code:

$model = new UserModel();
$user = new User([
    'name' => 'Fred \Flinstone',
    'email' => 'fred@example.com',
    'country' => 'US'
]);

$model->save($user);

$testUser = $model->findWhere(['name' => 'Fred \Flinstone']);
dd($testUser);

[daylightstudio]

Hmm... you are right. I'm having trouble replicating the issue now too. I don't see anything in the latest updates either that would seem to cause the change either. I spent like an hour trying to figure it out and I may have gone down the wrong path here. I'm going to close this issue for now. Sorry for the trouble... I know you have better things to do.