From: Sharon Rosner <ciconia@...>
Date: 2007-09-21T23:25:45+09:00
Subject: Re: ruby + mysql

> Lo stesso problema si pone per il comando insert: tutti gli esempi che
> ho trovato riportano:
>
> INSERT INTO tabella VALUES ('valore1','valore2', ...)
>
> se valore1 e' una variabile con un valore qualsiasi come devo fare per:
> dire a MySql che "valore1" e' una variabile;
> di inserire nel campo del database il contenuto di "valore1 e non la
> stringa "valore1" con Ruby?

Rough translation to English: How do I insert a value into the table
without literalizing it, so the value in the table would be the value
of the variable named valore1, instead of 'valore1'.

The simple answer to your question is this:

  sql = "INSERT INTO tabella VALUES ('#{valore1}', ...)"
  dbc.query(sql)

You can do the same with select statements:

  sql = "SELECT * FROM tabella WHERE '#{variable}' = colonna_tabella"
  dbc.query(sql)

However you'll soon run into SQL injection problems, so this is not
really the best way to go about it. May I suggest you use an ORM
library like Sequel, and then you can do stuff like:

  DB[:tabella].insert(valore1, valore2)

  DB[:tabella].filter {:colonna_tabella == variable}

Sequel will take care of proper string literalization and protect you
from SQL injection.

More info here:

  http://code.google.com/p/ruby-sequel/

best
Sharon