lundi 3 septembre 2018

How does ActiveRecord::Base.sanitize work?

How does ActiveRecord::Base.sanitize work? I searched its document, it was delegated to connection.quote(source), which finally does (source):

  def quote(value, column = nil)
    self.class.connection.quote(value, column)
  end

And the comment is

Quote strings appropriately for SQL statements.

I don't understand.

  1. Where is the real implementation of the quote for sanitize? The implementation I found seems is not the real implementation.
  2. For situation based on 1=1 is always true(example), will only adding appropriate quote work?

Aucun commentaire:

Enregistrer un commentaire