diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2004-12-07 10:37:50 +0000 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2004-12-07 10:37:50 +0000 |
commit | 3e7d191e6450a3050976c735b0efc11b8a0aee93 (patch) | |
tree | 1d954adc5207f7fcd231fe79e2fde0293e2b1d26 /activerecord/lib/active_record | |
parent | 5e3eaff5bb00c4d19d9ff2e80d32090e9515fe2c (diff) | |
download | rails-3e7d191e6450a3050976c735b0efc11b8a0aee93.tar.gz rails-3e7d191e6450a3050976c735b0efc11b8a0aee93.tar.bz2 rails-3e7d191e6450a3050976c735b0efc11b8a0aee93.zip |
Added bind-style variable interpolation for the condition arrays that uses the adapter's quote method [Michael Koziarski]
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@56 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
Diffstat (limited to 'activerecord/lib/active_record')
-rwxr-xr-x | activerecord/lib/active_record/base.rb | 26 |
1 files changed, 15 insertions, 11 deletions
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb index 1ebc843274..a45480945e 100755 --- a/activerecord/lib/active_record/base.rb +++ b/activerecord/lib/active_record/base.rb @@ -67,7 +67,7 @@ module ActiveRecord #:nodoc: # end # # def self.authenticate_safely(user_name, password) - # find_first([ "user_name = '%s' AND password = '%s'", user_name, password ]) + # find_first([ "user_name = ? AND password = ?", user_name, password ]) # end # end # @@ -76,10 +76,6 @@ module ActiveRecord #:nodoc: # on the other hand, will sanitize the <tt>user_name</tt> and +password+ before inserting them in the query, which will ensure that # an attacker can't escape the query and fake the login (or worse). # - # Beware, that the approach used in <tt>authenticate_unsafely</tt> is basically just a wrapped call to sprintf. This means that you - # still have to quote when using %s or use %d instead. So find_first([ "firm_id = %s", firm_id ]) is _not_ safe while both - # find_first([ "firm_id = '%s'", firm_id ]) and find_first([ "firm_id = %d", firm_id ]) are. - # # == Overwriting default accessors # # All column values are automatically available through basic accessors on the Active Record object, but some times you @@ -636,13 +632,21 @@ module ActiveRecord #:nodoc: # Accepts either a condition array or string. The string is returned untouched, but the array has each of # the condition values sanitized. def sanitize_conditions(conditions) - if Array === conditions - statement, values = conditions[0], conditions[1..-1] - values.collect! { |value| sanitize(value) } - conditions = statement % values + return conditions unless conditions.is_a?(Array) + + statement, values = conditions[0], conditions[1..-1] + + statement =~ /\?/ ? + replace_bind_variables(statement, values) : + statement % values.collect { |value| sanitize(value) } + end + + def replace_bind_variables(statement, values) + while statement =~ /\?/ + statement.sub!(/\?/, connection.quote(values.shift)) end - - return conditions + + return statement end end |