title: sql injection vulnerability to codeigniter or php
body: <p>Hello i want to know why this kind of example question never been asked before.
  i got this code from my college that they say this kind of code is able to prevent sql injection</p>
  
  <p>we use codeigniter to build a website and here is the code to prevent sql injection</p>
  
  <p>Controller</p>
  
  <pre><code>$usr = $this-&gt;input-&gt;post('userid');
  $pwd = $this-&gt;input-&gt;post('passwd');
  
  if($usr &amp;&amp; $pwd) {
                  $ack = $this-&gt;mAuth-&gt;get_user($usr);
  $pwx = $ack['passwd'];
                      if($ack &amp;&amp; $pwd == $pwx) {
                          //redirect code
  }
  </code></pre>
  
  <p>model</p>
  
  <pre><code>public function get_user($user_id='', $status=1) {
          $user_id = $this-&gt;db-&gt;escape(trim($user_id));
          $status  = $status ? 'and user_status_uid = 1' : '';
  
          $sql = "select * from users where user_id = lower($user_id)"
  
          return rst2Array($sql, 'row');
      }
  </code></pre>
  
  <p>i tried to login with 1' or 1 = 1 and etc i found and it did prevent sql injection even though it's only a plain text and password.</p>
  
  <p>is there any vulnerability to this code?
  thanks</p>