问在WHERE方法(Codeigniter)中使用SQL语句防止SQL注入

EN

    $where = "(color = '$color' AND flavor = '$flavor') OR (quality = '$quality' AND price = '$price')";
    $this->db->where($where);
    $result = $this->db->get('fruits');

$this->db->where('MATCH (field) AGAINST ("value")', NULL, FALSE);

    $where = "(color = '$color' AND flavor = '$flavor') OR (quality = '$quality' AND price = '$price')";
    $this->db->where($where, NULL, TRUE);
    $result = $this->db->get('fruits');

    $array = array('color' => $color,
                   'flavor' => $flavor,
                   'quality' => $quality,
                   'price' => $price);
    $where = "(color = ? AND flavor = ?) OR (quality = ? AND price = ?)";
    $this->db->where($where, $array, TRUE);
    $result = $this->db->get('fruits');