3

using raw SQL when I use the IN statement inside a query using sequel's fetch function, I can't escape a single quote by writing where stuff IN ...

@values='stuff1\'','stuff2\''

db.fetch("query...where IN (?)", "#{@values}")

outputs query...where stuff IN ('stuff1'',''stuff2') instead of ('stuff1','stuff2')

Quite frustrating that I'd probably have to write a Sequel equivalent for the raw query or use a different ORM just because of this escape issue. Any thoughts?

3 Answers 3

3

You should probably do something like:

@values = ['stuff1', 'stuff2']
db.fetch("query...where IN ?", @values)
1
  • If I am not mistaken my testing indicates that this will not work. The where clause generated will be: WHERE column in (N'stuff1' = N'stuff2') Apr 8, 2022 at 22:56
1

If I understand the Sequel documentation correctly, using String#lit or Sequel.lit should turn a Ruby string into a literal string and bypass the automatic escaping mechanism; therefore, this should work (untested):

@values='stuff1\'','stuff2\''.lit

db.fetch("query...where IN (?)", "#{@values}")

The usual caveats when working with raw SQL strings (SQL injection attacks, inefficient SQL due to forced re-parsing of statements etc.) apply :-)

0
0

This works:

values = Sequel.lit("'stuff1', 'stuff2'")
db.fetch("SELECT * FROM TABLE1 WHERE COL1 IN ?", values)

See also: How to pass a list to an IN clause via a placeholder with Ruby Sequel

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.