diff options
Diffstat (limited to 'activerecord/lib')
| -rwxr-xr-x | activerecord/lib/active_record/base.rb | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb index f52a1524d2..b876f83abb 100755 --- a/activerecord/lib/active_record/base.rb +++ b/activerecord/lib/active_record/base.rb @@ -274,21 +274,25 @@ module ActiveRecord #:nodoc: # Returns an array of all the objects that could be instantiated from the associated # table in the database. The +conditions+ can be used to narrow the selection of objects (WHERE-part), # such as by "color = 'red'", and arrangement of the selection can be done through +orderings+ (ORDER BY-part), - # such as by "last_name, first_name DESC". A maximum of returned objects can be specified in +limit+. Example: + # such as by "last_name, first_name DESC". A maximum of returned objects and their offset can be specified in + # +limit+ (LIMIT...OFFSET-part). Examples: # Project.find_all "category = 'accounts'", "last_accessed DESC", 15 + # Project.find_all ["category = ?", category_name], "created ASC", ["? OFFSET ?", 15, 20] def find_all(conditions = nil, orderings = nil, limit = nil, joins = nil) sql = "SELECT * FROM #{table_name} " sql << "#{joins} " if joins add_conditions!(sql, conditions) sql << "ORDER BY #{orderings} " unless orderings.nil? - sql << "LIMIT #{limit} " unless limit.nil? + sql << "LIMIT #{sanitize_conditions(limit)} " unless limit.nil? find_by_sql(sql) end - # Works like find_all, but requires a complete SQL string. Example: + # Works like find_all, but requires a complete SQL string. Examples: # Post.find_by_sql "SELECT p.*, c.author FROM posts p, comments c WHERE p.id = c.post_id" + # Post.find_by_sql ["SELECT * FROM posts WHERE author = ? AND created > ?", author_id, start_date] def find_by_sql(sql) + sql = sanitize_conditions(sql) connection.select_all(sql, "#{name} Load").inject([]) { |objects, record| objects << instantiate(record) } end @@ -360,6 +364,7 @@ module ActiveRecord #:nodoc: # Returns the result of an SQL statement that should only include a COUNT(*) in the SELECT part. # Product.count "SELECT COUNT(*) FROM sales s, customers c WHERE s.customer_id = c.id" def count_by_sql(sql) + sql = sanitize_conditions(sql) count = connection.select_one(sql, "#{name} Count").values.first return count ? count.to_i : 0 end @@ -1073,4 +1078,4 @@ module ActiveRecord #:nodoc: string[0..3] == "--- " end end -end
\ No newline at end of file +end |