Comments on: Ruby’s ActiveRecord Makes Dropping to Raw SQL a Royal Pain (Probably on Purpose)

By: rlucas

rlucas — Tue, 12 Jan 2010 19:51:29 +0000

Taelor, read the post again. It’s not about how to ship a plain string down the wire (duh) but how to get parameterized / placeholder-friendly queries with automatic escaping.

By: taelor

taelor — Sat, 09 Jan 2010 03:59:05 +0000

ActiveRecord::Base.connection.execute(“select count(*) from your_table_or_complicated_thing”).fetch_row[0]

I mean, your not “shit out of luck with ActiveRecord” right? Its even all in one line for you (not counting the sql of course).

By: Alfredo Rico

Alfredo Rico — Sat, 17 Oct 2009 18:48:25 +0000

class ActiveRecord::Base
def self.select_all_sanitizado(arreglo)
connection.select_all(sanitize_sql_array(arreglo))
end
end

By: Alfredo Rico

Alfredo Rico — Sat, 17 Oct 2009 18:19:24 +0000

Hi friend!.. I think there is a better way to do what you meant..

x = ActiveRecord::Base.connection.select_all( ActiveRecord::Base.send(“sanitize_sql_array”,["select foo from bar where name like = ?, var] ) )

Done!…

By: xc

xc — Thu, 27 Aug 2009 19:22:14 +0000

Also apparently sanitize_sql is deprecated, sanitize_sql_array works instead.

http://apidock.com/rails/ActiveRecord/Base/sanitize_sql/class

By: xc

xc — Thu, 27 Aug 2009 19:05:06 +0000

Thanks! I was looking for a way to do “?” queries like find_by_sql does with connection.select_all and this resolved it.