Search code examples
rubyescapingsinatrasequelquoting

quote value manually before passing to database


Everything's clear when WHERE clauses are concerned:

puts $DB[:users].where('field = ?', "'").sql   # SELECT * FROM `users` WHERE (field = '\'')
puts $DB[:users].where(field: "'").sql   # SELECT * FROM `users` WHERE (`field` = '\'')

But what about ORDER BY ones?

puts $DB[:users].order_by(
    ("field = '%s'" % "'").lit
).sql   # SELECT * FROM `users` ORDER BY field = '''

Solution

  • You could you quote to sanitize your string:

    puts $DB[:users].order_by(
        ("field = %s" % ActiveRecord::Base.connection.quote("'")).lit
    ).sql    # SELECT * FROM `users` ORDER BY field = ''''
    

    For sequel you should use literal_append:

    puts $DB[:users].order_by(
        ($DB[:users].literal_append("field = ", "'")).lit
    ).sql    # SELECT * FROM `users` ORDER BY field = ''''