数据库查询的条件传入字符串的时候 使用escapeString过滤

git-svn-id: http://thinkphp.googlecode.com/svn/trunk@2997 539fd3ec-2725-0410-b7ab-251e373a8e33

Author: liu21st@gmail.com

ThinkPHP/Lib/Core/Db.class.php

@@ -458,7 +458,7 @@ protected function parseWhere($where) {
  $whereStr = '';
  if(is_string($where)) {
  // 直接使用字符串条件
- $whereStr = $where;
+ $whereStr = $this->escapeString($where);
  }else{ // 使用数组或者对象条件表达式
  if(isset($where['_logic'])) {
  // 定义逻辑运算规则 例如 OR XOR AND NOT

ThinkPHP/Lib/Core/Model.class.php

@@ -1665,9 +1665,6 @@ public function scope($scope='',$args=NULL){
  +----------------------------------------------------------
  * @access public
  +----------------------------------------------------------
- * @param mixed $where
- * @param array $params
- +----------------------------------------------------------
  * @return Model
  +----------------------------------------------------------
  */