Several Active Record functions (including at least _where() and set()) have a parameter called $escape that provides a way to keep the value of the AR operation from being surrounded by apostrophes (to allow things like setting a timestamp field to NOW(), and presumably to allow subselects in the WHERE clause).
In set, the code looks like this:
if ($escape === FALSE)
{
$this->ar_set[$this->_protect_identifiers($k)] = $v;
}
else
{
$this->ar_set[$this->_protect_identifiers($k)] = $this->escape($v);
}
and in _where, like this:
if ($escape === TRUE)
{
// exception for "field<=" keys
if ($this->_has_operator($k))
{
$k = preg_replace("/([A-Za-z_0-9]+)/", $this->_protect_identifiers('$1'), $k);
}
else
{
$k = $this->_protect_identifiers($k);
}
}
if ( ! $this->_has_operator($k))
{
$k .= ' =';
}
$v = ' '.$this->escape($v);
These are obviously VERY different. In the SET operation, the key has _protect_identifiers called on it no matter what, and the value is only escaped if the $escape flag is set.
In the WHERE operation, the key only has _protect_identifiers called on it when the $escape flag is set, and the value is escaped no matter what.
Am I correct to assume that this is a bug and that the intended behavior is that _protect_identifiers should always be called, and that it is the escaping that is supposed to be controlled by the $escape flag?
