method

sanitize_limit

v4.2.9 - Show latest stable - 0 notes - Class: ActiveRecord::ConnectionAdapters::DatabaseStatements

sanitize_limit(limit) public

Sanitizes the given LIMIT parameter in order to prevent SQL injection.

The limit may be anything that can evaluate to a string via #to_s. It should look like an integer, or a comma-delimited list of integers, or an Arel SQL literal.

Returns Integer and Arel::Nodes::SqlLiteral limits as is. Returns the sanitized limit parameter, either as an integer, or as a string which contains a comma-delimited list of integers.

Show source

# File activerecord/lib/active_record/connection_adapters/abstract/database_statements.rb, line 319
      def sanitize_limit(limit)
        if limit.is_a?(Integer) || limit.is_a?(Arel::Nodes::SqlLiteral)
          limit
        elsif limit.to_s.include?(',')
          Arel.sql limit.to_s.split(',').map{ |i| Integer(i) }.join(',')
        else
          Integer(limit)
        end
      end

sanitize_limit

Related methods