title: SQL query escaping + codeigniter
body: <p>I'm using codeigniter and most of the time use active record for my queries (which automatically escapes them), but this query doesn't seem to fit neatly into it because of the variable. So I need to figure out how to escape the query manually.</p>
  
  <p>Codeigniter docs suggest escaping the queries this way:</p>
  
  <pre><code>$sql = "INSERT INTO table (title) VALUES(".$this-&gt;db-&gt;escape($title).")";
  </code></pre>
  
  <p><strong>My original query</strong></p>
  
  <pre><code>$sql = "SELECT * FROM (`user_language`) WHERE `user_id` = '{$id}'";
  </code></pre>
  
  <p><strong>My escaped query</strong></p>
  
  <pre><code>$sql = "SELECT * FROM (`user_language`) WHERE `user_id` = '{$id}' VALUES(".$this-&gt;db-&gt;escape($user_language).")";
  </code></pre>
  
  <p>But I'm having trouble getting the syntax right. Error messages are:</p>
  
  <ul>
  <li>PHP error message: Undefined variable: user_language </li>
  <li>SQL error: syntax wrong...near 'VALUES(NULL)' at line 1</li>
  </ul>