Is this SQL possible with Rails? How can I sanitize?

rubyonrails-talk
1

I want to do something like this in Rails: "SELECT *, COUNT(post_id) AS total FROM comments ... conditions"

Is that SELECT possible in Rails. Ohterwise, I can use find_by_sql, but i'm trying to avoid SQL injection and this SQL needs a parameter. Is there a way to sanitize this parameter?

I'll appreciate any help

2

"You can use the same string replacement techniques as you can with ActiveRecord#find."

http://api.rubyonrails.org/classes/ActiveRecord/Base.html#M002267

alternatively, does :select => "*, COUNT(post_id) AS total" in your Comments.find work?

3

Thanks a lot, find_by_sql worked! I tried to do the same, but I did not use the . I tried :select => ... also before asking, but that did not work.

pharrington wrote:

4

I tried :select => ... also before asking, but that did not work.

Mind showing us the query? It should work I belive...