diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2005-06-16 10:13:37 +0000 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2005-06-16 10:13:37 +0000 |
commit | c2ed453880539fbc27fc0e00a95fbcf9949d0ed6 (patch) | |
tree | 81b93f71a2b58f9484a584860ab26146a1243b3f /activerecord | |
parent | bdf51f958250fe5ed2c3c2f4f79ca6eb1e3dc5b1 (diff) | |
download | rails-c2ed453880539fbc27fc0e00a95fbcf9949d0ed6.tar.gz rails-c2ed453880539fbc27fc0e00a95fbcf9949d0ed6.tar.bz2 rails-c2ed453880539fbc27fc0e00a95fbcf9949d0ed6.zip |
Fix quote_bound_value to not map Strings #1416 [htonl]
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@1445 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
Diffstat (limited to 'activerecord')
-rwxr-xr-x | activerecord/lib/active_record/base.rb | 9 | ||||
-rw-r--r-- | activerecord/test/finder_test.rb | 4 |
2 files changed, 8 insertions, 5 deletions
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb index 08f749d3c8..0587b0bab8 100755 --- a/activerecord/lib/active_record/base.rb +++ b/activerecord/lib/active_record/base.rb @@ -895,11 +895,10 @@ module ActiveRecord #:nodoc: end def quote_bound_value(value) - case value - when Enumerable - value.map { |v| connection.quote(v) }.join(',') - else - connection.quote(value) + if (value.respond_to?(:map) && !value.is_a?(String)) + value.map { |v| connection.quote(v) }.join(',') + else + connection.quote(value) end end diff --git a/activerecord/test/finder_test.rb b/activerecord/test/finder_test.rb index bec7a2dcc0..307fd0934c 100644 --- a/activerecord/test/finder_test.rb +++ b/activerecord/test/finder_test.rb @@ -171,6 +171,10 @@ class FinderTest < Test::Unit::TestCase assert_equal %('a','b','c'), bind(':a', :a => Set.new(%w(a b c))) # ' end + def test_bind_string + assert_equal "''", bind('?', '') + end + def test_string_sanitation assert_not_equal "'something ' 1=1'", ActiveRecord::Base.sanitize("something ' 1=1") assert_equal "'something; select table'", ActiveRecord::Base.sanitize("something; select table") |