将数据从控制器传递到模型

Question

I'm having trouble passing data from my controller to my model using Codeigniter. I'm getting an Internal Server Error on the browser console but have narrowed it down to the issue outlined above.

Here is my code:

Controller

public function get_results() {
        $numOfDraws = $this->input->post('numOfDraws');
        $data = $this->lotto_model->get_results($numOfDraws);
        echo json_encode($data);
    }

Model

  public function get_results($numOfDraws)
        {
            $query = $this->db->query('SELECT * FROM lotto ORDER BY id DESC LIMIT "$numOfDraws"');
            return $query->result();
        }

If i hardcode the LIMIT the query works successfully. I know that $numOfDraws is equal to the correct value in the controller.

Can anyone advise?

Answer 1

First of all variable injection into a string only works with double quotes, not with single quotes. Secondly your current code is open to SQL injection.

CodeIgniter provides functionality to prevent this:

$query = $this->db->query('SELECT * FROM lotto ORDER BY id DESC LIMIT ?', array($numOfDraws));