On 2 Dec 2007, at 18:55, Ben Johnson wrote:
>
> I am writing a raw query and need to escape a variable that the user
> can
> modify. Similar to :conditions => ["whatever = ?", var]. What
function
> does this use behind the scenes?
>
Depending on what you want:
connection#quote
ActiveRecord::Base#quote_value
ActiveRecord::Base#sanitize_sql (which turns ["whatever = ?", var]
into "whatever = ''var''"
Fred> Thanks!
> --
> Posted via http://www.ruby-forum.com/.
>
> >
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---