ActiveRecord#sanitize_sql_array method changes integer to string

Question

I recently upgraded the rails version of my application from 6.1 to 7. After upgrading I found that sanitize_sql_array is now changing the integer values to string.

Below are the attributes that I am passing to the method:

updates = ["`bed_count` = `bed_count` + ?", "`operating_room_count` = `operating_room_count` + ?", "`updated_at` = ?"]
values = [3.14159, 1, "2022-09-17 18:15:05"]

Now when the run the method I get the following output:

>> ActiveRecord::Base.send(:sanitize_sql_array, [updates.join(','), *values])
=> "`bed_count` = `bed_count` + '3.14159',`operating_room_count` = `operating_room_count` + '1',`updated_at` = '2022-09-17 18:33:44'"

Notice that the 3.14159 and 1 is now changed to string even though I provided integer values.

When I ran the same code in Rails 6.1, I got the following output:

"`bed_count` = `bed_count` + 3.14159,`operating_room_count` = `operating_room_count` + 1,`updated_at` = '2022-09-17 18:33:44'"

Does anybody know how can I fix this ?

I've tried on 7.0.3.1 and they are numeric. BTW, why do you use send? It's public method, you can ActiveRecord::Base.sanitize_sql_array([updates.join(','), *values]) — mechnicov
– mechnicov, Commented Sep 17, 2022 at 19:20
@mechnicov I again tried with ActiveRecord::Base.sanitize_sql_array([updates.join(','), *values]) but still got the same output with string instead of numeric. "bed_count = bed_count + '3.14159',operating_room_count = operating_room_count + '1',updated_at = '2022-09-17 18:15:05'" — Dev V
– Dev V, Commented Sep 17, 2022 at 19:53

Adam Zapaśnik · Accepted Answer · 2022-09-21 17:22:08Z

2

seems to be related to https://github.com/rails/rails/pull/42440?

The MySQL adapter now cast numbers and booleans bind parameters to string for safety reasons.

I guess they're working on a fix for your problem here: https://github.com/rails/rails/pull/45379

Think the best workaround right now is to cast the strings to integer/decimals in the SQL like this:

...bed_count` + CAST(? as UNSIGNED)
# or 
CAST(? as DECIMAL)

answered Sep 21, 2022 at 17:22

Adam Zapaśnik

6834 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ActiveRecord#sanitize_sql_array method changes integer to string

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related