SQL where value combination of 0 and sha1(value, true) in CodeIgniter's Active Records returns all rows

So this is my conclusion of the real problem from a question I asked earlier here: SQL Select Query with CodeIgniter's active records and 'where sha1' returns first row entry

I'm also double posting in the CodeIgniter forum: http://codeigniter.com/forums/viewthread/194502/ (latest progress...)

You can get several code snippets from both.

In short, the problem I am having is the following and I'm not sure who's really the culprit:

I am using an array as shown below to define the 'where' in a select query for an active records function. The query gives me all the rows in the table if used in the certain combination outlined below.

pasting---

it actually looks like this combination of error only happens when sha1 returns raw output data and email < 1 For instance:

$where = array(
          'email'     => 0,
          'password'  => sha1(false, true), # sha1($this->input>post('password'), true);
         ); 

if sha1(false, true) is changed to sha1(whatever) there is no error. (‘whatever’ includes strings, booleans, etc.)

if array is unchanged and 'email' => 0 is chang开发者_运维问答ed to 'email' => '0' which happens in the SQL QueryA, then it works correctly. If I remove the ‘‘s from the value in QueryA as in Active Records then I get all the rows again …

Also, I do not get any rows (which is correct) when 'email' is > 0. i.e. 'email' => 1 (2,3,etc) and even when 'email' => null.

The combination of ‘email’ = 0 and sha1(‘any value’, true) results in returning EVERY row in the table in the Active Records because there’s no quotes added to the value 0. Quotes are however added around the ‘password’ = ‘value’. If there are no quotes around the raw hash, then SQL returns an Error and prevents the script from running.. (which is better than returning ever row…)

This could be an SQL error since it only happens on a value of 0... but is it user error to not quote a where value? If so, then should Active Records should quote the value for me automatically if it is an integer or not? It seems to do it for string values, but not integers (false = 0, true = 1)...

If you want the same result in your queries, write the two equal. In QUERY1 you define your terms as follows:

WHERE `email` = \''.$data['email'].'\' 
AND `password` = \''.$data['password'].'\' 

in QUERY2

# data for sql query
$where = array(
    'email'     => $this->input->post('email'),
    'password'  => sha1($this->input->post('password'), true);
);

For QUERY1 and QUERY2 are equal, QUERY2 would be:

# data for sql query
$where = array(
    'email'     => "'".$this->input->post('email')."'",
    'password'  => sha1($this->input->post('password'), true);
);

Codeigniter can not determine by itself that 0 should not be a number. You do it yourself as QUERY1.