@@ -2055,9 +2055,10 @@ module ActiveRecord #:nodoc: end def replace_named_bind_variables(statement, bind_vars) #:nodoc: - statement.gsub(/:([a-zA-Z]\w*)/) do - match = $1.to_sym - if bind_vars.include?(match) + statement.gsub(/(:?):([a-zA-Z]\w*)/) do + if $1 == ':' # skip postgresql casts + $& # return the whole match + elsif bind_vars.include?(match = $2.to_sym) quote_bound_value(bind_vars[match]) else raise PreparedStatementInvalid, "missing value for :#{match} in #{statement}" activerecord/lib/active_record/base.rb @@ -1,5 +1,6 @@ require "cases/helper" require 'models/author' +require 'models/categorization' require 'models/comment' require 'models/company' require 'models/topic' @@ -394,6 +395,12 @@ class FinderTest < ActiveRecord::TestCase assert_equal '1,1,1', bind('?', os) end + def test_named_bind_with_postgresql_type_casts + l = Proc.new { bind(":a::integer '2009-01-01'::date", :a => '10') } + assert_nothing_raised(&l) + assert_equal "#{ActiveRecord::Base.quote_value('10')}::integer '2009-01-01'::date", l.call + end + def test_string_sanitation assert_not_equal "#{ActiveRecord::Base.connection.quoted_string_prefix}'something ' 1=1'", ActiveRecord::Base.sanitize("something ' 1=1") assert_equal "#{ActiveRecord::Base.connection.quoted_string_prefix}'something; select table'", ActiveRecord::Base.sanitize("something; select table") activerecord/test/cases/finder_test.rb 2e1b56c93745bf0513e449e95830edd390abfaf2 Tarmo Tänav tarmo@itech.ee http://github.com/rails/rails/commit/509374ebe2dba0dc2ea7e44d67a6f8d530d12fac 509374ebe2dba0dc2ea7e44d67a6f8d530d12fac 2008-06-22T16:16:06-07:00 2008-05-12T07:58:03-07:00 Named bind variables can now be used with postgresql-style typecasts For example :conditions => ['stringcol::integer = :var', { :var => 10 }] will no longer raise an exception about ':integer' having a missing value. 6ee9f77d5f0d21c3921d0de8cf5c23bc4e0fe133 Jeremy Kemper jeremy@bitsweat.net