DB_TABLE sql injection concerns

[pixelterra]

There's something I haven't been able to determine regarding SQL injection protection with DB_TABLE. Since this is a security issue, I have to be DEAD sure I know what's going on before I recommend that db_table be used for an upcoming project.

I know that I can preview the sql statement built with sql query arrays using buildSQL(), but how do I see the sql statement that will be used when using insert/update/delete statements before they are exectuted.

It is not clear from the documentation if I need to manually escape the data values for insert/update/delete or if this is taken care of automatically with db_table and I can't find a way to look at the actual sql generated behind the scenes. Since there is no DB_Table_Database->escape() function, I've been using the $mdb2->escape() func to make sure my "where" values for upadate statements are safe.

The following code might highlight my confusion:

$row = array(
'first_name' => "ba'd",
);

$where = "' OR 'a' = 'a";
$r = $db->update('test', $row, "username = '$where'");

The the value in the data array seems to be automatically escaped, but the value of $where isn't, but the value of the 'where' argument (#3) isn't, and thus the above is a valid SQL injection. I can solve this problem like this:

$where = $mdb2->escape($where);

But I'm still confused as to whether this should be necessary or not. When I manually escape the data in the data array, the escapes appear in the db:

$row = array(
'first_name' => $mdb2->escape("ba'd"),
);

So it seems the data is automatically escaped, but not the 'where' arguement. So my questions are these: s it a valid conclusion that the values in the data array are automagically escaped, but values used in other places of the sql statement are not, like the $where clause above?

BML

[mark]

[pixelterra]

[mark]