title: Codeigniter issue with escaping values when passing array to query with "in" in the where clause
body: <p>I have the function below in my model for a codeigniter project, and the variable <code>$id</code> is an array and for example, contains <code>(1,2,3)</code>. Now that i'm revisiting it, I think that i'm not actually escaping my array <code>$id</code>. I think I would have to change the line 
  <code>$this-&gt;db-&gt;escape($id)</code>
  to
  <code>$id = $this-&gt;db-&gt;escape($id)</code></p>
  
  <p>If I do that, then it puts single quotes around every element in the array and treats it as one long string like this: <code>'(1,2,3)'</code>. </p>
  
  <p>Can someone confirm that I am not actually escaping my variable and either suggest a solution or let me know if this is a bug within the codeigniter framework?</p>
  
  <pre><code>function get_ratings($id)
      {
  
          $this-&gt;db-&gt;escape($id); // had to manually escape the variable since it's being used in an "in" in the where clause. 
  
          $sql = "select * from toys t
                   where t.toy_id in ($id)";
  
          $query = $this-&gt;db-&gt;query($sql, $id);
  
          if($query-&gt;num_rows() &gt; 0)
          {
              return $query-&gt;result_array();
          }
          else
          {
              return false;
          }
      }
  </code></pre>