0
# Conditions can either be specified as a string, array, or hash representing the WHERE-part of an SQL statement.
0
# The array form is to be used when the condition input is tainted and requires sanitization. The string form can
0
# be used for statements that don't involve tainted data. The hash form works much like the array form, except
0
- # only equality
is possible. Examples:
0
+ # only equality
and range is possible. Examples:
0
# class User < ActiveRecord::Base
0
# def self.authenticate_unsafely(user_name, password)
0
# Student.find(:all, :conditions => { :first_name => "Harvey", :status => 1 })
0
# Student.find(:all, :conditions => params[:student])
0
+ # A range may be used in the hash to use the SQL BETWEEN operator:
0
+ # Student.find(:all, :conditions => { :grade => 9..12 })
0
# == Overwriting default accessors
0
# All column values are automatically available through basic accessors on the Active Record object, but some times you
0
when Array then "IN (?)"
0
+ when Range then "BETWEEN ? AND ?"
0
# # => "name='foo''bar' and group_id= 4"
0
# { :status => nil, :group_id => [1,2,3] }
0
# # => "status IS NULL and group_id IN (1,2,3)"
0
+ # # => "age BETWEEN 13 AND 18"
0
def sanitize_sql_hash(attrs)
0
conditions = attrs.map do |attr, value|
0
"#{table_name}.#{connection.quote_column_name(attr)} #{attribute_condition(value)}"
0
- replace_bind_variables(conditions,
attrs.values)
0
+ replace_bind_variables(conditions,
expand_range_bind_variables(attrs.values))
0
# Accepts an array of conditions. The array has each value
0
raise PreparedStatementInvalid, "missing value for :#{match} in #{statement}"
0
+ def expand_range_bind_variables(bind_vars) #:nodoc:
0
+ bind_vars.each_with_index do |var, index|
0
+ bind_vars[index, 1] = [var.first, var.last] if var.is_a?(Range)
0
def quote_bound_value(value) #:nodoc:
Comments
No one has commented yet.