Rails - escaping SQL params

Question

I am doing some plain SQLs in my rails model (for purists this is just for complex SQLs :)

Since I am not using find*/condition methods, is there a helper method that I can use straight to do that?

Answer 1

The quote method on the connection object escapes strings. When building up queries, use sanitize_sql_for_conditions to convert ActiveRecord conditions hashes or arrays to SQL WHERE clauses.

The methods in ActiveRecord::ConnectionAdapters::DatabaseStatements are handy for direct queries, in particular the ones starting with select_.