Module: SQL::Maker::Quoting
- Defined in:
- lib/sql/maker/quoting.rb
Class Method Summary collapse
-
.escape(s) ⇒ Object
alias to module function quote_string.
-
.quote(value, column = nil) ⇒ Object
Quotes the value rather than column name to help prevent SQL injection attacks.
-
.quote_column_name(column_name) ⇒ Object
Quotes the column name.
-
.quote_string(s) ⇒ Object
Quotes a string, escaping any ‘ (single quote) and \ (backslash) characters as SQL escape.
-
.quote_table_name(table_name) ⇒ Object
Quotes the table name.
-
.quote_table_name_for_assignment(table, attr) ⇒ Object
Override to return the quoted table name for assignment.
- .quoted_date(value) ⇒ Object
- .quoted_false ⇒ Object
- .quoted_true ⇒ Object
-
.type_cast(value, column) ⇒ Object
Cast a
value
to a type that the database understands.
Class Method Details
.escape(s) ⇒ Object
alias to module function quote_string
82 83 84 |
# File 'lib/sql/maker/quoting.rb', line 82 def self.escape(s) quote_string(s) end |
.quote(value, column = nil) ⇒ Object
Quotes the value rather than column name to help prevent SQL injection attacks.
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
# File 'lib/sql/maker/quoting.rb', line 8 def self.quote(value, column = nil) case value when String value = value.to_s return "'#{quote_string(value)}'" unless column case column.type when :integer then value.to_i.to_s when :float then value.to_f.to_s else "'#{quote_string(value)}'" end when true, false if column && column.type == :integer value ? '1' : '0' else value ? quoted_true : quoted_false end # BigDecimals need to be put in a non-normalized form and quoted. when nil then "NULL" when BigDecimal then value.to_s('F') when Numeric then value.to_s when Date, Time then "'#{quoted_date(value)}'" when Symbol then "'#{quote_string(value.to_s)}'" when Class then "'#{value.to_s}'" else "'#{quote_string(YAML.dump(value))}'" end end |
.quote_column_name(column_name) ⇒ Object
Quotes the column name. Defaults to no quoting.
108 109 110 |
# File 'lib/sql/maker/quoting.rb', line 108 def self.quote_column_name(column_name) column_name end |
.quote_string(s) ⇒ Object
Quotes a string, escaping any ‘ (single quote) and \ (backslash) characters as SQL escape
77 78 79 |
# File 'lib/sql/maker/quoting.rb', line 77 def self.quote_string(s) s.gsub(/\\/, '\&\&').gsub(/'/, "''") # ' (for ruby-mode) end |
.quote_table_name(table_name) ⇒ Object
Quotes the table name. Defaults to column name quoting.
113 114 115 |
# File 'lib/sql/maker/quoting.rb', line 113 def self.quote_table_name(table_name) quote_column_name(table_name) end |
.quote_table_name_for_assignment(table, attr) ⇒ Object
Override to return the quoted table name for assignment. Defaults to table quoting.
This works for mysql and mysql2 where table.column can be used to resolve ambiguity.
We override this in the sqlite and postgresql adapters to use only the column name (as per syntax requirements).
125 126 127 |
# File 'lib/sql/maker/quoting.rb', line 125 def self.quote_table_name_for_assignment(table, attr) quote_table_name("#{table}.#{attr}") end |
.quoted_date(value) ⇒ Object
137 138 139 140 141 142 143 |
# File 'lib/sql/maker/quoting.rb', line 137 def self.quoted_date(value) if value.is_a?(Time) # ToDo: getutc support value = value.getlocal end value.strftime("%Y-%m-%d %H:%M:%S") end |
.quoted_false ⇒ Object
133 134 135 |
# File 'lib/sql/maker/quoting.rb', line 133 def self.quoted_false "'f'" end |
.quoted_true ⇒ Object
129 130 131 |
# File 'lib/sql/maker/quoting.rb', line 129 def self.quoted_true "'t'" end |
.type_cast(value, column) ⇒ Object
Cast a value
to a type that the database understands. For example, SQLite does not understand dates, so this method will convert a Date to a String.
42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
# File 'lib/sql/maker/quoting.rb', line 42 def self.type_cast(value, column) return value.id if value.respond_to?(:quoted_id) case value when String value = value.to_s return value unless column case column.type when :integer then value.to_i when :float then value.to_f else value end when true, false if column && column.type == :integer value ? 1 : 0 else value ? 't' : 'f' end # BigDecimals need to be put in a non-normalized form and quoted. when nil then nil when BigDecimal then value.to_s('F') when Numeric then value when Date, Time then quoted_date(value) when Symbol then value.to_s else to_type = column ? " to #{column.type}" : "" raise TypeError, "can't cast #{value.class}#{to_type}" end end |