CODEWITHSUNDEEP
sqlruby-on-railswhere-clausequotescomposition
valk
valk

Reputation: 9894

Passing a string in where clause in Rails is always quoted

I'm trying to compose programmatically the .where() clause.

It looks like

Post.where("description ?", @composite)

Where @composite is a string which is constructed before. It may be something like = 'ABCD' or maybe IS LIKE 'ABCD' etc.

Problem is in the resulting SQL it's always single-quoted. For example:

Post Load (0.2ms)  SELECT `posts`.* FROM `posts` WHERE (description 'IS LIKE "ABCD"')

Is there any way to "un-quote" it?

Upvotes: 0

Views: 515

Answers (2)

Ahmad Hussain
Ahmad Hussain

Reputation: 2491

Use this:

Post.where("description #{@composite}")

Upvotes: 0

Dave Newton
Dave Newton

Reputation: 160271

The = and IS LIKE should not be part of the string you're passing in.

It's being single-quoted because that's precisely what the ? does: SQL-safed quoting.

If you want to completely construct the SQL yourself then do so, e.g.,

Post.where("description #{@composite}")

You'll need to sanitize the string yourself, which is easy since presumably you're constructing the = or IS LIKE part with input.

Upvotes: 1

Related Questions