module SQLRecord::SanitizedQuery

Public Instance Methods

find(params={}) click to toggle source

Executes the {#query} proc on your database, building SQLRecords with the results. @param params [Hash] a hash of parameters that are yielded to the {#query} proc @return [Array] {SQLRecord::Base}s with their raw_attributes set to the row results.

# File lib/sql_record/sanitized_query.rb, line 6
def find params={}
  rows = execute_query params

  rows.map do |row|
    new row
  end
end
query(&deferred) click to toggle source

Specifies the query to execute @yield the block that will be executed with each {#find} @yieldparam [Hash] params the parametrs passed in from {#find} @yieldreturn [Array, String] Either the sql string or a sanitize array to be executed. @note

do not try to sanitize identifiers, only values will sanitize well
  ["where id = ?", 1] => "where id = 1"
  ["where name = ?", "hello"] => "where id = 'hello'"
  ["ORDER BY ? ASC", "id"] => "ORDER BY 'id' ASC"  << not legitimate SQL
# File lib/sql_record/sanitized_query.rb, line 23
def query &deferred
  @query_proc = deferred
end

Protected Instance Methods

execute_query(params={}) click to toggle source

@todo check that this logs the sql @todo Write own sanitizer: (www.ruby-forum.com/topic/187658)

sanitize_sql_array sanitizes values correctly, not identifiers, eg:
["where id = ?", 1] => "where id = 1"
["where name = ?", "hello"] => "where id = 'hello'"
["ORDER BY ? ASC", "id"] => "ORDER BY 'id' ASC"  << not legitimate SQL
# File lib/sql_record/sanitized_query.rb, line 35
def execute_query params={}
  sql = get_query(params)
  sql = ActiveRecord::Base.send(:sanitize_sql_array, sql) if sql.is_a?(Array)
  ActiveRecord::Base.connection.execute(sql)
end
get_query(params) click to toggle source
# File lib/sql_record/sanitized_query.rb, line 41
def get_query(params)
    @query_proc.call(params)
end