From: "Michael J. I. Jackson" <mjijackson@...>
Date: 2009-05-24T13:34:42+09:00
Subject: Re: How to sanitize sql-column names?

Sorry, it was just a guess! Those place holders are obviously only for
user values then. You'll just have to use quote_column_name to
interpolate the string manually.

Have fun,

Michael

On Sat, May 23, 2009 at 10:30 AM, Jan Lühr <usenet@stephan.homeunix.net> wrote:
> Hello,
>
> Michael J. I. Jackson schrieb:
>>
>> You could do something like this:
>>
>> Address.find(:all, :conditions => ['? LIKE ?',
>> Address.connection.quote_column_name("last_name"), "Luehr" ])
>>
>> It's a bit more verbose, but I think it should work.
>
> ehm no:
> SELECT * FROM `addresses` WHERE ('`last_name`' LIKE 'Luehr')
>
> Keep smiling
> yanosz
>
>