module SQL::Maker::Quoting
Public Class Methods
escape(s)
click to toggle source
alias to module function quote_string
# File lib/sql/maker/quoting.rb, line 82 def self.escape(s) quote_string(s) end
quote(value, column = nil)
click to toggle source
Quotes the value rather than column name to help prevent SQL injection attacks.
# File lib/sql/maker/quoting.rb, line 8 def self.quote(value, column = nil) case value when String value = value.to_s return "'#{quote_string(value)}'" unless column case column.type when :integer then value.to_i.to_s when :float then value.to_f.to_s else "'#{quote_string(value)}'" end when true, false if column && column.type == :integer value ? '1' : '0' else value ? quoted_true : quoted_false end # BigDecimals need to be put in a non-normalized form and quoted. when nil then "NULL" when BigDecimal then value.to_s('F') when Numeric then value.to_s when Date, Time then "'#{quoted_date(value)}'" when Symbol then "'#{quote_string(value.to_s)}'" when Class then "'#{value.to_s}'" else "'#{quote_string(YAML.dump(value))}'" end end
quote_column_name(column_name)
click to toggle source
Quotes the column name. Defaults to no quoting.
# File lib/sql/maker/quoting.rb, line 108 def self.quote_column_name(column_name) column_name end
quote_string(s)
click to toggle source
Quotes a string, escaping any ‘ (single quote) and \ (backslash) characters as SQL
escape
# File lib/sql/maker/quoting.rb, line 77 def self.quote_string(s) s.gsub(/\\/, '\&\&').gsub(/'/, "''") # ' (for ruby-mode) end
quote_table_name(table_name)
click to toggle source
Quotes the table name. Defaults to column name quoting.
# File lib/sql/maker/quoting.rb, line 113 def self.quote_table_name(table_name) quote_column_name(table_name) end
quote_table_name_for_assignment(table, attr)
click to toggle source
Override to return the quoted table name for assignment. Defaults to table quoting.
This works for mysql and mysql2 where table.column can be used to resolve ambiguity.
We override this in the sqlite and postgresql adapters to use only the column name (as per syntax requirements).
# File lib/sql/maker/quoting.rb, line 125 def self.quote_table_name_for_assignment(table, attr) quote_table_name("#{table}.#{attr}") end
quoted_date(value)
click to toggle source
# File lib/sql/maker/quoting.rb, line 137 def self.quoted_date(value) if value.is_a?(Time) # ToDo: getutc support value = value.getlocal end value.strftime("%Y-%m-%d %H:%M:%S") end
quoted_false()
click to toggle source
# File lib/sql/maker/quoting.rb, line 133 def self.quoted_false "'f'" end
quoted_true()
click to toggle source
# File lib/sql/maker/quoting.rb, line 129 def self.quoted_true "'t'" end
type_cast(value, column)
click to toggle source
Cast a value
to a type that the database understands. For example, SQLite does not understand dates, so this method will convert a Date to a String.
# File lib/sql/maker/quoting.rb, line 42 def self.type_cast(value, column) return value.id if value.respond_to?(:quoted_id) case value when String value = value.to_s return value unless column case column.type when :integer then value.to_i when :float then value.to_f else value end when true, false if column && column.type == :integer value ? 1 : 0 else value ? 't' : 'f' end # BigDecimals need to be put in a non-normalized form and quoted. when nil then nil when BigDecimal then value.to_s('F') when Numeric then value when Date, Time then quoted_date(value) when Symbol then value.to_s else to_type = column ? " to #{column.type}" : "" raise TypeError, "can't cast #{value.class}#{to_type}" end end