Feedback for PR 13008: SQL sanitization in AR::QueryMethods#order

rubyonrails-core
1

I’m looking for feedback on PR #13008: Support SQL sanitization in AR::QueryMethods#order.

Currently, you can’t do SQL sanitized interpolation like ['?', param] with AREL order clauses.

This sanitization would be useful for complex order clauses, e.g. like MySQL ORDER BY FIELD(field, values...):

Post.order(“field(id, ?)”, [2,3,1])

…or geolocation sorting in Postgresql:

Location.order(‘st_distance(latlon, ?) < ?’, location, distance)

Without this patch, developers must remember to sanitize their inputs with more verbose, less common use methods.