Currently the .where() method will take the first parameter and put it in back ticks while making the second parameter an value for a prepared statement. This should be okay for the very most cases, but if the user does something odd it like trying to put the value first and then the column name it might not work - or worse: It works but is now SQL Injectable.
Another issues potential issue is the free choice of the operator which will be simply plugged in between. If the user puts a variable in that place it is another SQL injection potential. I think some option to limit this would be appropriate.
Anyway the question is: what should it ideally do and what is an acceptable simplification?
Currently the
.where()method will take the first parameter and put it in back ticks while making the second parameter an value for a prepared statement. This should be okay for the very most cases, but if the user does something odd it like trying to put the value first and then the column name it might not work - or worse: It works but is now SQL Injectable.Another issues potential issue is the free choice of the operator which will be simply plugged in between. If the user puts a variable in that place it is another SQL injection potential. I think some option to limit this would be appropriate.
Anyway the question is: what should it ideally do and what is an acceptable simplification?