Module: ActiveRecord::ConnectionAdapters::Quoting
- Included in:
- AbstractAdapter
- Defined in:
- lib/active_record/connection_adapters/abstract/quoting.rb
Instance Method Summary collapse
-
#quote(value, column = nil) ⇒ Object
Quotes the column value to help prevent SQL injection attacks.
-
#quote_column_name(column_name) ⇒ Object
Quotes the column name.
-
#quote_string(s) ⇒ Object
Quotes a string, escaping any ‘ (single quote) and \ (backslash) characters.
-
#quote_table_name(table_name) ⇒ Object
Quotes the table name.
-
#quote_table_name_for_assignment(table, attr) ⇒ Object
Override to return the quoted table name for assignment.
- #quoted_date(value) ⇒ Object
- #quoted_false ⇒ Object
- #quoted_true ⇒ Object
-
#type_cast(value, column) ⇒ Object
Cast a
value
to a type that the database understands.
Instance Method Details
#quote(value, column = nil) ⇒ Object
Quotes the column value to help prevent SQL injection attacks.
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 8 def quote(value, column = nil) # records are quoted as their primary key return value.quoted_id if value.respond_to?(:quoted_id) case value when String, ActiveSupport::Multibyte::Chars value = value.to_s return "'#{quote_string(value)}'" unless column case column.type when :integer then value.to_i.to_s when :float then value.to_f.to_s else "'#{quote_string(value)}'" end when true, false if column && column.type == :integer value ? '1' : '0' else value ? quoted_true : quoted_false end # BigDecimals need to be put in a non-normalized form and quoted. when nil then "NULL" when BigDecimal then value.to_s('F') when Numeric, ActiveSupport::Duration if column.try(:type) == :string quote(value.to_s, column) else value.to_s end when Date, Time then "'#{quoted_date(value)}'" when Symbol then "'#{quote_string(value.to_s)}'" when Class then "'#{value.to_s}'" else "'#{quote_string(YAML.dump(value))}'" end end |
#quote_column_name(column_name) ⇒ Object
Quotes the column name. Defaults to no quoting.
92 93 94 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 92 def quote_column_name(column_name) column_name end |
#quote_string(s) ⇒ Object
Quotes a string, escaping any ‘ (single quote) and \ (backslash) characters.
87 88 89 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 87 def quote_string(s) s.gsub(/\\/, '\&\&').gsub(/'/, "''") # ' (for ruby-mode) end |
#quote_table_name(table_name) ⇒ Object
Quotes the table name. Defaults to column name quoting.
97 98 99 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 97 def quote_table_name(table_name) quote_column_name(table_name) end |
#quote_table_name_for_assignment(table, attr) ⇒ Object
Override to return the quoted table name for assignment. Defaults to table quoting.
This works for mysql and mysql2 where table.column can be used to resolve ambiguity.
We override this in the sqlite and postgresql adapters to use only the column name (as per syntax requirements).
109 110 111 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 109 def quote_table_name_for_assignment(table, attr) quote_table_name("#{table}.#{attr}") end |
#quoted_date(value) ⇒ Object
121 122 123 124 125 126 127 128 129 130 131 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 121 def quoted_date(value) if value.acts_like?(:time) zone_conversion_method = ActiveRecord::Base.default_timezone == :utc ? :getutc : :getlocal if value.respond_to?(zone_conversion_method) value = value.send(zone_conversion_method) end end value.to_s(:db) end |
#quoted_false ⇒ Object
117 118 119 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 117 def quoted_false "'f'" end |
#quoted_true ⇒ Object
113 114 115 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 113 def quoted_true "'t'" end |
#type_cast(value, column) ⇒ Object
Cast a value
to a type that the database understands. For example, SQLite does not understand dates, so this method will convert a Date to a String.
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 |
# File 'lib/active_record/connection_adapters/abstract/quoting.rb', line 50 def type_cast(value, column) if value.respond_to?(:quoted_id) && value.respond_to?(:id) return value.id end case value when String, ActiveSupport::Multibyte::Chars value = value.to_s return value unless column case column.type when :integer then value.to_i when :float then value.to_f else value end when true, false if column && column.type == :integer value ? 1 : 0 else value ? 't' : 'f' end # BigDecimals need to be put in a non-normalized form and quoted. when nil then nil when BigDecimal then value.to_s('F') when Numeric then value when Date, Time then quoted_date(value) when Symbol then value.to_s else to_type = column ? " to #{column.type}" : "" raise TypeError, "can't cast #{value.class}#{to_type}" end end |