Possible SQL injection

[bytestream]

Source: https://github.com/yadakhov/insert-on-duplicate-key/blob/master/src/InsertOnDuplicateKey.php#L207

Example: insertOnDuplicateKey(..., [ 'col' => 'value' ])

This just sticks 'value' straight into the SQL without sanitisation: ON DUPLICATE KEY UPDATE col = value

@yadakhov

[yadakhov]

Doing some research it looks like the best solution is to use the mysql_real_escape_string https://stackoverflow.com/questions/6646731/how-does-sprintf-protect-against-sql-injection

I'll add it and do some testing.