How does ActiveRecord::Base.sanitize
work? I searched its document, it was delegated to connection.quote
(source), which finally does (source):
def quote(value, column = nil)
self.class.connection.quote(value, column)
end
And the comment is
Quote strings appropriately for SQL statements.
I don't understand.
- Where is the real implementation of the
quote
for sanitize? The implementation I found seems is not the real implementation. - For situation based on 1=1 is always true(example), will only adding appropriate quote work?
Aucun commentaire:
Enregistrer un commentaire