Method: ActiveRecord::Sanitization::ClassMethods#sanitize_sql_array

Defined in:
activerecord/lib/active_record/sanitization.rb

#sanitize_sql_array(ary) ⇒ Object

Accepts an array of conditions. The array has each value sanitized and interpolated into the SQL statement. If using named bind variables in SQL statements where a colon is required verbatim use a backslash to escape.

sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
# => "name='foo''bar' and group_id=4"

sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
# => "name='foo''bar' and group_id=4"

sanitize_sql_array(["TO_TIMESTAMP(:date, 'YYYY/MM/DD HH12\\:MI\\:SS')", date: "foo"])
# => "TO_TIMESTAMP('foo', 'YYYY/MM/DD HH12:MI:SS')"

sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
# => "name='foo''bar' and group_id='4'"

Note that this sanitization method is not schema-aware, hence won’t do any type casting and will directly use the database adapter’s quote method. For MySQL specifically this means that numeric parameters will be quoted as strings to prevent query manipulation attacks.

sanitize_sql_array(["role = ?", 0])
# => "role = '0'"



163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'activerecord/lib/active_record/sanitization.rb', line 163

def sanitize_sql_array(ary)
  statement, *values = ary
  if values.first.is_a?(Hash) && /:\w+/.match?(statement)
    with_connection do |c|
      replace_named_bind_variables(c, statement, values.first)
    end
  elsif statement.include?("?")
    with_connection do |c|
      replace_bind_variables(c, statement, values)
    end
  elsif statement.blank?
    statement
  else
    with_connection do |c|
      statement % values.collect { |value| c.quote_string(value.to_s) }
    end
  end
end