So before anyone beats the hell out of me, I know how to do this when calling Arel methods. What I'm curious about is if there is a way to simply get that sql injection safe version of the user input so I have it in hand and can do w开发者_高级运维hat I want with it.
Ideally I'd be interested in something along the lines of:
safe_input_data = Person.sql_safe params[:user_data_for_arel_manipulation]
I spent some time last night looking for something that would do this but found nothing. I read all the ActiveRecord methods, but there is jack in the way of documentation. Going simply by the method names and the source of those methods I didn't see anything. I'm hoping someone knows of something.
This will give you an sql safe string:
safe_input_data = Person.sanitize(params[:user_data_for_arel_manipulation])
Be aware, it also adds single quotes to your string!
So "my unsafe input"
becomes "'my unsafe input'"
.
精彩评论