title: Codeigniter: update_batch not escaping field names
body: <p>I am trying to use the <code>update_batch()</code> function from the Active Record helper in Codeigniter as follows: </p>
  
  <pre><code>var_dump($data);
  $this-&gt;db-&gt;where('event_id',$data['event_id']);
  $this-&gt;db-&gt;update_batch('results',$data['results'],'uid');
  echo $this-&gt;db-&gt;last_query();
  </code></pre>
  
  <p>This prints out the following:</p>
  
  <pre><code>array(2) {
    ["event_id"]=&gt;
    string(2) "11"
    ["results"]=&gt;
    array(2) {
      [0]=&gt;
      array(2) {
        ["uid"]=&gt;
        string(36) "1beab26d-f705-11e0-a190-f46d048dfd25"
        ["res"]=&gt;
        string(1) "2"
      }
      [1]=&gt;
      array(2) {
        ["uid"]=&gt;
        string(36) "9dcc9e0a-bf24-11e0-838c-f46d048dfd25"
        ["res"]=&gt;
        string(1) "1"
      }
    }
  }
  UPDATE results SET res = CASE 
  WHEN uid = '1beab26d-f705-11e0-a190-f46d048dfd25' THEN '2'
  WHEN uid = '9dcc9e0a-bf24-11e0-838c-f46d048dfd25' THEN '1'
  ELSE res END WHERE `event_id` = '11' AND uid IN ('1beab26d-f705-11e0-a190-f46d048dfd25','9dcc9e0a-bf24-11e0-838c-f46d048dfd25')
  </code></pre>
  
  <p>Obviously, this is a large security hole because the field and table names are not being escaped from the <code>update_batch</code> section (although they are escaped in the <code>where</code> section). Am I doing something wrong? This behaviour is not specified in the docs:</p>
  
  <p><a href="http://codeigniter.com/user_guide/database/active_record.html#update" rel="nofollow">http://codeigniter.com/user_guide/database/active_record.html#update</a></p>