ActiveRecord::ConnectionAdapters::Quoting

quote(value, column = nil)

Quotes the column value to help prevent SQL injection attacks.

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 8
def quote(value, column = nil)
  # records are quoted as their primary key
  return value.quoted_id if value.respond_to?(:quoted_id)

  case value
  when String, ActiveSupport::Multibyte::Chars
    value = value.to_s
    return "'#{quote_string(value)}'" unless column

    case column.type
    when :binary then "'#{quote_string(column.string_to_binary(value))}'"
    when :integer then value.to_i.to_s
    when :float then value.to_f.to_s
    else
      "'#{quote_string(value)}'"
    end

  when true, false
    if column && column.type == :integer
      value ? '1' : '0'
    else
      value ? quoted_true : quoted_false
    end
    # BigDecimals need to be put in a non-normalized form and quoted.
  when nil        then "NULL"
  when BigDecimal then value.to_s('F')
  when Numeric    then value.to_s
  when Date, Time then "'#{quoted_date(value)}'"
  when Symbol     then "'#{quote_string(value.to_s)}'"
  else
    "'#{quote_string(YAML.dump(value))}'"
  end
end

quote_column_name(column_name)

Quotes the column name. Defaults to no quoting.

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 85
def quote_column_name(column_name)
  column_name
end

quote_string(s)

Quotes a string, escaping any ‘ (single quote) and \ (backslash) characters.

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 80
def quote_string(s)
  s.gsub(%r\\/, '\&\&').gsub(%r'/, "''") # ' (for ruby-mode)
end

quote_table_name(table_name)

Quotes the table name. Defaults to column name quoting.

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 90
def quote_table_name(table_name)
  quote_column_name(table_name)
end

quoted_date(value)

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 102
def quoted_date(value)
  if value.acts_like?(:time)
    zone_conversion_method = ActiveRecord::Base.default_timezone == :utc ? :getutc : :getlocal

    if value.respond_to?(zone_conversion_method)
      value = value.send(zone_conversion_method)
    end
  end

  value.to_s(:db)
end

quoted_false()

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 98
def quoted_false
  "'f'"
end

quoted_true()

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 94
def quoted_true
  "'t'"
end

type_cast(value, column)

Cast a value to a type that the database understands. For example, SQLite does not understand dates, so this method will convert a Date to a String.

Source: show | on GitHub

# File activerecord/lib/active_record/connection_adapters/abstract/quoting.rb, line 45
def type_cast(value, column)
  return value.id if value.respond_to?(:quoted_id)

  case value
  when String, ActiveSupport::Multibyte::Chars
    value = value.to_s
    return value unless column

    case column.type
    when :binary then value
    when :integer then value.to_i
    when :float then value.to_f
    else
      value
    end

  when true, false
    if column && column.type == :integer
      value ? 1 : 0
    else
      value ? 't' : 'f'
    end
    # BigDecimals need to be put in a non-normalized form and quoted.
  when nil        then nil
  when BigDecimal then value.to_s('F')
  when Numeric    then value
  when Date, Time then quoted_date(value)
  when Symbol     then value.to_s
  else
    YAML.dump(value)
  end
end

Module ActiveRecord::ConnectionAdapters::Quoting