From 18c0c568da7b6ab4c518bbf4fcfa76666923a11b Mon Sep 17 00:00:00 2001 From: Jordan Bostrom Date: Fri, 6 Aug 2021 16:58:38 -0500 Subject: [PATCH] docs: use Arel.sql examples that require Arel.sql --- activerecord/lib/active_record/errors.rb | 4 ++-- activerecord/lib/arel.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/activerecord/lib/active_record/errors.rb b/activerecord/lib/active_record/errors.rb index 2e8d3e800c9..c8e4fe86122 100644 --- a/activerecord/lib/active_record/errors.rb +++ b/activerecord/lib/active_record/errors.rb @@ -470,12 +470,12 @@ module ActiveRecord # # For example, the following code would raise this exception: # - # Post.order("length(title)").first + # Post.order("REPLACE(title, 'misc', 'zzzz') asc").pluck(:id) # # The desired result can be accomplished by wrapping the known-safe string # in Arel.sql: # - # Post.order(Arel.sql("length(title)")).first + # Post.order(Arel.sql("REPLACE(title, 'misc', 'zzzz') asc")).pluck(:id) # # Again, such a workaround should *not* be used when passing user-provided # values, such as request parameters or model attributes to query methods. diff --git a/activerecord/lib/arel.rb b/activerecord/lib/arel.rb index 148508461c4..bb84d272abd 100644 --- a/activerecord/lib/arel.rb +++ b/activerecord/lib/arel.rb @@ -29,7 +29,7 @@ module Arel # Wrap a known-safe SQL string for passing to query methods, e.g. # - # Post.order(Arel.sql("length(title)")).last + # Post.order(Arel.sql("REPLACE(title, 'misc', 'zzzz') asc")).pluck(:id) # # Great caution should be taken to avoid SQL injection vulnerabilities. # This method should not be used with unsafe values such as request