title: Does CodeIgniter automatically prevent SQL injection?
body: <p>I just inherited a project because the last developer left.   The project is built off of Code Igniter.  I've never worked with Code Igniter before.</p>
  
  <p>I took a quick look at the code and I see database calls in the controller like this:</p>
  
  <pre><code>$dbResult = $this-&gt;db-&gt;query("SELECT * FROM users WHERE username = '".$_POST['user_name']."'");
  </code></pre>
  
  <p>or calls like this:</p>
  
  <pre><code>$dbResult = $this-&gt;db-&gt;query("SELECT * FROM users WHERE username = '".$this-&gt;input-&gt;post('username')."'");
  </code></pre>
  
  <p>Does code igniter automatically sanitize these queries to prevent sql injection?</p>