sql - 带有 select_all 的 Rails 准备好的语句

Question

据我所知，应该可以在 Rails 中执行以下操作:

ActiveRecord::Base.connection.select_all("SELECT MONTH(created) AS month, YEAR(created) AS year FROM orders WHERE created>=$1 AND created<=$2 GROUP BY month ORDER BY month ASC",nil,[['created',1],['created',2]])

但可悲的是，这根本不起作用。无论我尝试使用什么格式， $1和 $2永远不会被绑定(bind)数组中的相应值替换。

我还有什么需要注意的吗？

Answer 1

您应该使用 sanitize_sql_array在你的模型中，像这样:

r = self.sanitize_sql_array(["SELECT MONTH(created) AS month, YEAR(created) AS year FROM orders WHERE created>=? AND created<=? GROUP BY month ORDER BY month ASC", created1, created2])
self.connection.select_all r

这可以保护您免受 SQL 注入(inject)。