CODEWITHSUNDEEP
sqlruby-on-railsruby-on-rails-4activerecordsanitization
Colton Voege
Colton Voege

Reputation: 419

sanitize_sql_array in Rails 4

In a Rails 3 model you used to be able to do:

query = self.sanitize_sql_array(["SELECT MONTH(created) AS month, YEAR(created) AS year FROM orders WHERE created>=? AND created<=? GROUP BY month ORDER BY month ASC", created1, created2])

However this has been removed from rails for and apparently moved to "ActiveRecord::Sanitization::ClassMethods" (http://api.rubyonrails.org/classes/ActiveRecord/Sanitization/ClassMethods.html#method-i-sanitize_sql_for_assignment). But I've tried calling ActiveRecord::Sanitization.sanitize_sql_array(...) and I get the error:

undefined method 'sanitize_sql_array' for ActiveRecord::Sanitization:Module

Can someone help me with this? Or provide a better option to sanitize the query like I'm trying to pass? Thank you!

Upvotes: 4

Views: 3793

Answers (1)

Reutzesen
Reutzesen

Reputation: 180

Try this..

ActiveRecord::Base.connection.select_all(
    ActiveRecord::Base.send(:sanitize_sql_array, 
                            ["select created_at as month from orders where date(created_at) >= ?", '2015-12-21']
    )
)

Upvotes: 4

Related Questions