Quotes the column value to help prevent SQL injection attacks.
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 8 def quote(value, column = nil) # records are quoted as their primary key return value.quoted_id if value.respond_to?(:quoted_id) case value when String, ActiveSupport::Multibyte::Chars value = value.to_s return "'#{quote_string(value)}'" unless column case column.type when :binary then "'#{quote_string(column.string_to_binary(value))}'" when :integer then value.to_i.to_s when :float then value.to_f.to_s else "'#{quote_string(value)}'" end when true, false if column && column.type == :integer value ? '1' : '0' elsif column && [:text, :string, :binary].include?(column.type) value ? "'1'" : "'0'" else value ? quoted_true : quoted_false end # BigDecimals need to be put in a non-normalized form and quoted. when nil then "NULL" when Numeric, ActiveSupport::Duration value = BigDecimal === value ? value.to_s('F') : value.to_s if column && ![:integer, :float, :decimal].include?(column.type) value = "'#{value}'" end value when Date, Time then "'#{quoted_date(value)}'" when Symbol then "'#{quote_string(value.to_s)}'" else "'#{quote_string(YAML.dump(value))}'" end end
Quotes the column name. Defaults to no quoting.
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 91 def quote_column_name(column_name) column_name end
Quotes a string, escaping any ' (single quote) and \ (backslash) characters.
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 86 def quote_string(s) s.gsub(%r\\/, '\&\&').gsub(%r'/, "''") # ' (for ruby-mode) end
Quotes the table name. Defaults to column name quoting.
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 96 def quote_table_name(table_name) quote_column_name(table_name) end
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 108 def quoted_date(value) if value.acts_like?(:time) zone_conversion_method = ActiveRecord::Base.default_timezone == :utc ? :getutc : :getlocal if value.respond_to?(zone_conversion_method) value = value.send(zone_conversion_method) end end value.to_s(:db) end
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 104 def quoted_false "'f'" end
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 100 def quoted_true "'t'" end
Cast a value
to a type that the database understands. For
example, SQLite does not understand dates, so this method will convert a
Date to a String.
# File lib/active_record/connection_adapters/abstract/quoting.rb, line 51 def type_cast(value, column) return value.id if value.respond_to?(:quoted_id) case value when String, ActiveSupport::Multibyte::Chars value = value.to_s return value unless column case column.type when :binary then value when :integer then value.to_i when :float then value.to_f else value end when true, false if column && column.type == :integer value ? 1 : 0 else value ? 't' : 'f' end # BigDecimals need to be put in a non-normalized form and quoted. when nil then nil when BigDecimal then value.to_s('F') when Numeric then value when Date, Time then quoted_date(value) when Symbol then value.to_s else YAML.dump(value) end end