activerecord 5.0.7.2 → 5.1.0.beta1

data/lib/active_record/relation/record_fetch_warning.rb

@@ -2,15 +2,15 @@ module ActiveRecord
   class Relation
     module RecordFetchWarning
       # When this module is prepended to ActiveRecord::Relation and
-      # `config.active_record.warn_on_records_fetched_greater_than` is
+      # +config.active_record.warn_on_records_fetched_greater_than+ is
       # set to an integer, if the number of records a query returns is
-      # greater than the value of `warn_on_records_fetched_greater_than`,
+      # greater than the value of +warn_on_records_fetched_greater_than+,
       # a warning is logged. This allows for the detection of queries that
       # return a large number of records, which could cause memory bloat.
       #
       # In most cases, fetching large number of records can be performed
       # efficiently using the ActiveRecord::Batches methods.
-      # See active_record/lib/relation/batches.rb for more information.
+      # See ActiveRecord::Batches for more information.
       def exec_queries
         QueryRegistry.reset
 

data/lib/active_record/relation/spawn_methods.rb

@@ -1,10 +1,9 @@
-require 'active_support/core_ext/hash/except'
-require 'active_support/core_ext/hash/slice'
-require 'active_record/relation/merger'
+require "active_support/core_ext/hash/except"
+require "active_support/core_ext/hash/slice"
+require "active_record/relation/merger"
 
 module ActiveRecord
   module SpawnMethods
-
     # This is overridden by Associations::CollectionProxy
     def spawn #:nodoc:
       clone
@@ -67,7 +66,7 @@ module ActiveRecord
 
     private
 
-      def relation_with(values) # :nodoc:
+      def relation_with(values)
         result = Relation.create(klass, table, predicate_builder, values)
         result.extend(*extending_values) if extending_values.any?
         result

data/lib/active_record/relation/where_clause.rb

@@ -25,10 +25,7 @@ module ActiveRecord
       end
 
       def except(*columns)
-        WhereClause.new(
-          predicates_except(columns),
-          binds_except(columns),
-        )
+        WhereClause.new(*except_predicates_and_binds(columns))
       end
 
       def or(other)
@@ -84,91 +81,108 @@ module ActiveRecord
         @empty ||= new([], [])
       end
 
+      # TODO Change this to private once we've dropped Ruby 2.2 support.
+      # Workaround for Ruby 2.2 "private attribute?" warning.
       protected
 
-      attr_reader :predicates
+        attr_reader :predicates
 
-      def referenced_columns
-        @referenced_columns ||= begin
-          equality_nodes = predicates.select { |n| equality_node?(n) }
-          Set.new(equality_nodes, &:left)
+        def referenced_columns
+          @referenced_columns ||= begin
+            equality_nodes = predicates.select { |n| equality_node?(n) }
+            Set.new(equality_nodes, &:left)
+          end
         end
-      end
 
       private
 
-      def predicates_unreferenced_by(other)
-        predicates.reject do |n|
-          equality_node?(n) && other.referenced_columns.include?(n.left)
+        def predicates_unreferenced_by(other)
+          predicates.reject do |n|
+            equality_node?(n) && other.referenced_columns.include?(n.left)
+          end
         end
-      end
-
-      def equality_node?(node)
-        node.respond_to?(:operator) && node.operator == :==
-      end
 
-      def non_conflicting_binds(other)
-        conflicts = referenced_columns & other.referenced_columns
-        conflicts.map! { |node| node.name.to_s }
-        binds.reject { |attr| conflicts.include?(attr.name) }
-      end
+        def equality_node?(node)
+          node.respond_to?(:operator) && node.operator == :==
+        end
 
-      def inverted_predicates
-        predicates.map { |node| invert_predicate(node) }
-      end
+        def non_conflicting_binds(other)
+          conflicts = referenced_columns & other.referenced_columns
+          conflicts.map! { |node| node.name.to_s }
+          binds.reject { |attr| conflicts.include?(attr.name) }
+        end
 
-      def invert_predicate(node)
-        case node
-        when NilClass
-          raise ArgumentError, 'Invalid argument for .where.not(), got nil.'
-        when Arel::Nodes::In
-          Arel::Nodes::NotIn.new(node.left, node.right)
-        when Arel::Nodes::Equality
-          Arel::Nodes::NotEqual.new(node.left, node.right)
-        when String
-          Arel::Nodes::Not.new(Arel::Nodes::SqlLiteral.new(node))
-        else
-          Arel::Nodes::Not.new(node)
+        def inverted_predicates
+          predicates.map { |node| invert_predicate(node) }
         end
-      end
 
-      def predicates_except(columns)
-        predicates.reject do |node|
+        def invert_predicate(node)
           case node
-          when Arel::Nodes::Between, Arel::Nodes::In, Arel::Nodes::NotIn, Arel::Nodes::Equality, Arel::Nodes::NotEqual, Arel::Nodes::LessThan, Arel::Nodes::LessThanOrEqual, Arel::Nodes::GreaterThan, Arel::Nodes::GreaterThanOrEqual
-            subrelation = (node.left.kind_of?(Arel::Attributes::Attribute) ? node.left : node.right)
-            columns.include?(subrelation.name.to_s)
+          when NilClass
+            raise ArgumentError, "Invalid argument for .where.not(), got nil."
+          when Arel::Nodes::In
+            Arel::Nodes::NotIn.new(node.left, node.right)
+          when Arel::Nodes::Equality
+            Arel::Nodes::NotEqual.new(node.left, node.right)
+          when String
+            Arel::Nodes::Not.new(Arel::Nodes::SqlLiteral.new(node))
+          else
+            Arel::Nodes::Not.new(node)
           end
         end
-      end
 
-      def binds_except(columns)
-        binds.reject do |attr|
-          columns.include?(attr.name)
+        def except_predicates_and_binds(columns)
+          except_binds = []
+          binds_index = 0
+
+          predicates = self.predicates.reject do |node|
+            except = \
+              case node
+              when Arel::Nodes::Between, Arel::Nodes::In, Arel::Nodes::NotIn, Arel::Nodes::Equality, Arel::Nodes::NotEqual, Arel::Nodes::LessThan, Arel::Nodes::LessThanOrEqual, Arel::Nodes::GreaterThan, Arel::Nodes::GreaterThanOrEqual
+                binds_contains = node.grep(Arel::Nodes::BindParam).size
+                subrelation = (node.left.kind_of?(Arel::Attributes::Attribute) ? node.left : node.right)
+                columns.include?(subrelation.name.to_s)
+              end
+
+            if except && binds_contains > 0
+              (binds_index...(binds_index + binds_contains)).each do |i|
+                except_binds[i] = true
+              end
+
+              binds_index += binds_contains
+            end
+
+            except
+          end
+
+          binds = self.binds.reject.with_index do |_, i|
+            except_binds[i]
+          end
+
+          [predicates, binds]
         end
-      end
 
-      def predicates_with_wrapped_sql_literals
-        non_empty_predicates.map do |node|
-          if Arel::Nodes::Equality === node
-            node
-          else
-            wrap_sql_literal(node)
+        def predicates_with_wrapped_sql_literals
+          non_empty_predicates.map do |node|
+            if Arel::Nodes::Equality === node
+              node
+            else
+              wrap_sql_literal(node)
+            end
           end
         end
-      end
 
-      ARRAY_WITH_EMPTY_STRING = ['']
-      def non_empty_predicates
-        predicates - ARRAY_WITH_EMPTY_STRING
-      end
+        ARRAY_WITH_EMPTY_STRING = [""]
+        def non_empty_predicates
+          predicates - ARRAY_WITH_EMPTY_STRING
+        end
 
-      def wrap_sql_literal(node)
-        if ::String === node
-          node = Arel.sql(node)
+        def wrap_sql_literal(node)
+          if ::String === node
+            node = Arel.sql(node)
+          end
+          Arel::Nodes::Grouping.new(node)
         end
-        Arel::Nodes::Grouping.new(node)
-      end
     end
   end
 end

data/lib/active_record/relation/where_clause_factory.rb

@@ -7,8 +7,6 @@ module ActiveRecord
       end
 
       def build(opts, other)
-        binds = []
-
         case opts
         when String, Array
           parts = [klass.send(:sanitize_sql, other.empty? ? opts : ([opts] + other))]
@@ -17,22 +15,63 @@ module ActiveRecord
           attributes = klass.send(:expand_hash_conditions_for_aggregates, attributes)
           attributes.stringify_keys!
 
-          attributes, binds = predicate_builder.create_binds(attributes)
-
-          parts = predicate_builder.build_from_hash(attributes)
+          if perform_case_sensitive?(options = other.last)
+            parts, binds = build_for_case_sensitive(attributes, options)
+          else
+            attributes, binds = predicate_builder.create_binds(attributes)
+            parts = predicate_builder.build_from_hash(attributes)
+          end
         when Arel::Nodes::Node
           parts = [opts]
-          binds = other
         else
           raise ArgumentError, "Unsupported argument type: #{opts} (#{opts.class})"
         end
 
-        WhereClause.new(parts, binds)
+        WhereClause.new(parts, binds || [])
       end
 
+      # TODO Change this to private once we've dropped Ruby 2.2 support.
+      # Workaround for Ruby 2.2 "private attribute?" warning.
       protected
 
-      attr_reader :klass, :predicate_builder
+        attr_reader :klass, :predicate_builder
+
+      private
+
+        def perform_case_sensitive?(options)
+          options && options.key?(:case_sensitive)
+        end
+
+        def build_for_case_sensitive(attributes, options)
+          parts, binds = [], []
+          table = klass.arel_table
+
+          attributes.each do |attribute, value|
+            if reflection = klass._reflect_on_association(attribute)
+              attribute = reflection.foreign_key.to_s
+              value = value[reflection.klass.primary_key] unless value.nil?
+            end
+
+            if value.nil?
+              parts << table[attribute].eq(value)
+            else
+              column = klass.column_for_attribute(attribute)
+
+              binds << predicate_builder.send(:build_bind_param, attribute, value)
+              value = Arel::Nodes::BindParam.new
+
+              predicate = if options[:case_sensitive]
+                klass.connection.case_sensitive_comparison(table, attribute, column, value)
+              else
+                klass.connection.case_insensitive_comparison(table, attribute, column, value)
+              end
+
+              parts << predicate
+            end
+          end
+
+          [parts, binds]
+        end
     end
   end
 end

data/lib/active_record/result.rb

@@ -32,8 +32,6 @@ module ActiveRecord
   class Result
     include Enumerable
 
-    IDENTITY_TYPE = Type::Value.new # :nodoc:
-
     attr_reader :columns, :rows, :column_types
 
     def initialize(columns, rows, column_types = {})
@@ -103,36 +101,36 @@ module ActiveRecord
 
     private
 
-    def column_type(name, type_overrides = {})
-      type_overrides.fetch(name) do
-        column_types.fetch(name, IDENTITY_TYPE)
+      def column_type(name, type_overrides = {})
+        type_overrides.fetch(name) do
+          column_types.fetch(name, Type.default_value)
+        end
       end
-    end
 
-    def hash_rows
-      @hash_rows ||=
-        begin
-          # We freeze the strings to prevent them getting duped when
-          # used as keys in ActiveRecord::Base's @attributes hash
-          columns = @columns.map { |c| c.dup.freeze }
-          @rows.map { |row|
-            # In the past we used Hash[columns.zip(row)]
-            #  though elegant, the verbose way is much more efficient
-            #  both time and memory wise cause it avoids a big array allocation
-            #  this method is called a lot and needs to be micro optimised
-            hash = {}
-
-            index = 0
-            length = columns.length
-
-            while index < length
-              hash[columns[index]] = row[index]
-              index += 1
-            end
-
-            hash
-          }
-        end
-    end
+      def hash_rows
+        @hash_rows ||=
+          begin
+            # We freeze the strings to prevent them getting duped when
+            # used as keys in ActiveRecord::Base's @attributes hash
+            columns = @columns.map { |c| c.dup.freeze }
+            @rows.map { |row|
+              # In the past we used Hash[columns.zip(row)]
+              #  though elegant, the verbose way is much more efficient
+              #  both time and memory wise cause it avoids a big array allocation
+              #  this method is called a lot and needs to be micro optimised
+              hash = {}
+
+              index = 0
+              length = columns.length
+
+              while index < length
+                hash[columns[index]] = row[index]
+                index += 1
+              end
+
+              hash
+            }
+          end
+      end
   end
 end

data/lib/active_record/runtime_registry.rb

@@ -1,4 +1,4 @@
-require 'active_support/per_thread_registry'
+require "active_support/per_thread_registry"
 
 module ActiveRecord
   # This is a thread locals registry for Active Record. For example:
@@ -12,9 +12,9 @@ module ActiveRecord
   class RuntimeRegistry # :nodoc:
     extend ActiveSupport::PerThreadRegistry
 
-    attr_accessor :connection_handler, :sql_runtime, :connection_id
+    attr_accessor :connection_handler, :sql_runtime
 
-    [:connection_handler, :sql_runtime, :connection_id].each do |val|
+    [:connection_handler, :sql_runtime].each do |val|
       class_eval %{ def self.#{val}; instance.#{val}; end }, __FILE__, __LINE__
       class_eval %{ def self.#{val}=(x); instance.#{val}=x; end }, __FILE__, __LINE__
     end

data/lib/active_record/sanitization.rb

@@ -1,230 +1,215 @@
+
 module ActiveRecord
   module Sanitization
     extend ActiveSupport::Concern
 
     module ClassMethods
-      # Used to sanitize objects before they're used in an SQL SELECT statement.
-      # Delegates to {connection.quote}[rdoc-ref:ConnectionAdapters::Quoting#quote].
-      def sanitize(object) # :nodoc:
-        connection.quote(object)
-      end
-      alias_method :quote_value, :sanitize
-
-      protected
-
-      # Accepts an array or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for a WHERE clause.
-      #
-      #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
-      #   # => "name='foo''bar' and group_id=4"
-      #
-      #   sanitize_sql_for_conditions(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
-      #   # => "name='foo''bar' and group_id='4'"
-      #
-      #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
-      #   # => "name='foo''bar' and group_id='4'"
-      #
-      #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
-      #   # => "name='foo''bar' and group_id='4'"
-      def sanitize_sql_for_conditions(condition)
-        return nil if condition.blank?
-
-        case condition
-        when Array; sanitize_sql_array(condition)
-        else        condition
+      private
+
+        # Accepts an array or string of SQL conditions and sanitizes
+        # them into a valid SQL fragment for a WHERE clause.
+        #
+        #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
+        #   # => "name='foo''bar' and group_id=4"
+        #
+        #   sanitize_sql_for_conditions(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
+        #   # => "name='foo''bar' and group_id='4'"
+        #
+        #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
+        #   # => "name='foo''bar' and group_id='4'"
+        #
+        #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
+        #   # => "name='foo''bar' and group_id='4'"
+        def sanitize_sql_for_conditions(condition) # :doc:
+          return nil if condition.blank?
+
+          case condition
+          when Array; sanitize_sql_array(condition)
+          else        condition
+          end
         end
-      end
-      alias_method :sanitize_sql, :sanitize_sql_for_conditions
-      alias_method :sanitize_conditions, :sanitize_sql
-
-      # Accepts an array, hash, or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for a SET clause.
-      #
-      #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
-      #   # => "name=NULL and group_id=4"
-      #
-      #   sanitize_sql_for_assignment(["name=:name and group_id=:group_id", name: nil, group_id: 4])
-      #   # => "name=NULL and group_id=4"
-      #
-      #   Post.send(:sanitize_sql_for_assignment, { name: nil, group_id: 4 })
-      #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
-      #
-      #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
-      #   # => "name=NULL and group_id='4'"
-      def sanitize_sql_for_assignment(assignments, default_table_name = self.table_name)
-        case assignments
-        when Array; sanitize_sql_array(assignments)
-        when Hash;  sanitize_sql_hash_for_assignment(assignments, default_table_name)
-        else        assignments
+        alias :sanitize_sql :sanitize_sql_for_conditions
+        alias :sanitize_conditions :sanitize_sql
+        deprecate sanitize_conditions: :sanitize_sql
+
+        # Accepts an array, hash, or string of SQL conditions and sanitizes
+        # them into a valid SQL fragment for a SET clause.
+        #
+        #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
+        #   # => "name=NULL and group_id=4"
+        #
+        #   sanitize_sql_for_assignment(["name=:name and group_id=:group_id", name: nil, group_id: 4])
+        #   # => "name=NULL and group_id=4"
+        #
+        #   Post.send(:sanitize_sql_for_assignment, { name: nil, group_id: 4 })
+        #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
+        #
+        #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
+        #   # => "name=NULL and group_id='4'"
+        def sanitize_sql_for_assignment(assignments, default_table_name = table_name) # :doc:
+          case assignments
+          when Array; sanitize_sql_array(assignments)
+          when Hash;  sanitize_sql_hash_for_assignment(assignments, default_table_name)
+          else        assignments
+          end
         end
-      end
-
-      # Accepts an array, or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for an ORDER clause.
-      #
-      #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
-      #   # => "field(id, 1,3,2)"
-      #
-      #   sanitize_sql_for_order("id ASC")
-      #   # => "id ASC"
-      def sanitize_sql_for_order(condition)
-        if condition.is_a?(Array) && condition.first.to_s.include?('?')
-          sanitize_sql_array(condition)
-        else
-          condition
+
+        # Accepts an array, or string of SQL conditions and sanitizes
+        # them into a valid SQL fragment for an ORDER clause.
+        #
+        #   sanitize_sql_for_order(["field(id, ?)", [1,3,2]])
+        #   # => "field(id, 1,3,2)"
+        #
+        #   sanitize_sql_for_order("id ASC")
+        #   # => "id ASC"
+        def sanitize_sql_for_order(condition) # :doc:
+          if condition.is_a?(Array) && condition.first.to_s.include?("?")
+            sanitize_sql_array(condition)
+          else
+            condition
+          end
         end
-      end
-
-      # Accepts a hash of SQL conditions and replaces those attributes
-      # that correspond to a {#composed_of}[rdoc-ref:Aggregations::ClassMethods#composed_of]
-      # relationship with their expanded aggregate attribute values.
-      #
-      # Given:
-      #
-      #   class Person < ActiveRecord::Base
-      #     composed_of :address, class_name: "Address",
-      #       mapping: [%w(address_street street), %w(address_city city)]
-      #   end
-      #
-      # Then:
-      #
-      #   { address: Address.new("813 abc st.", "chicago") }
-      #   # => { address_street: "813 abc st.", address_city: "chicago" }
-      def expand_hash_conditions_for_aggregates(attrs)
-        expanded_attrs = {}
-        attrs.each do |attr, value|
-          if aggregation = reflect_on_aggregation(attr.to_sym)
-            mapping = aggregation.mapping
-            mapping.each do |field_attr, aggregate_attr|
-              if mapping.size == 1 && !value.respond_to?(aggregate_attr)
-                expanded_attrs[field_attr] = value
-              else
-                expanded_attrs[field_attr] = value.send(aggregate_attr)
+
+        # Accepts a hash of SQL conditions and replaces those attributes
+        # that correspond to a {#composed_of}[rdoc-ref:Aggregations::ClassMethods#composed_of]
+        # relationship with their expanded aggregate attribute values.
+        #
+        # Given:
+        #
+        #   class Person < ActiveRecord::Base
+        #     composed_of :address, class_name: "Address",
+        #       mapping: [%w(address_street street), %w(address_city city)]
+        #   end
+        #
+        # Then:
+        #
+        #   { address: Address.new("813 abc st.", "chicago") }
+        #   # => { address_street: "813 abc st.", address_city: "chicago" }
+        def expand_hash_conditions_for_aggregates(attrs) # :doc:
+          expanded_attrs = {}
+          attrs.each do |attr, value|
+            if aggregation = reflect_on_aggregation(attr.to_sym)
+              mapping = aggregation.mapping
+              mapping.each do |field_attr, aggregate_attr|
+                if mapping.size == 1 && !value.respond_to?(aggregate_attr)
+                  expanded_attrs[field_attr] = value
+                else
+                  expanded_attrs[field_attr] = value.send(aggregate_attr)
+                end
               end
+            else
+              expanded_attrs[attr] = value
             end
-          else
-            expanded_attrs[attr] = value
           end
+          expanded_attrs
         end
-        expanded_attrs
-      end
-
-      # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
-      #
-      #   sanitize_sql_hash_for_assignment({ status: nil, group_id: 1 }, "posts")
-      #   # => "`posts`.`status` = NULL, `posts`.`group_id` = 1"
-      def sanitize_sql_hash_for_assignment(attrs, table)
-        c = connection
-        attrs.map do |attr, value|
-          if value.is_a?(Base)
-            require "active_support/core_ext/string/filters"
-            ActiveSupport::Deprecation.warn(<<-WARNING.squish)
-              Passing `ActiveRecord::Base` objects to
-              `sanitize_sql_hash_for_assignment` (or methods which call it,
-              such as `update_all`) is deprecated. Please pass the id directly,
-              instead.
-            WARNING
-          else
+
+        # Sanitizes a hash of attribute/value pairs into SQL conditions for a SET clause.
+        #
+        #   sanitize_sql_hash_for_assignment({ status: nil, group_id: 1 }, "posts")
+        #   # => "`posts`.`status` = NULL, `posts`.`group_id` = 1"
+        def sanitize_sql_hash_for_assignment(attrs, table) # :doc:
+          c = connection
+          attrs.map do |attr, value|
             value = type_for_attribute(attr.to_s).serialize(value)
-          end
-          "#{c.quote_table_name_for_assignment(table, attr)} = #{c.quote(value)}"
-        end.join(', ')
-      end
-
-      # Sanitizes a +string+ so that it is safe to use within an SQL
-      # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
-      #
-      #   sanitize_sql_like("100%")
-      #   # => "100\\%"
-      #
-      #   sanitize_sql_like("snake_cased_string")
-      #   # => "snake\\_cased\\_string"
-      #
-      #   sanitize_sql_like("100%", "!")
-      #   # => "100!%"
-      #
-      #   sanitize_sql_like("snake_cased_string", "!")
-      #   # => "snake!_cased!_string"
-      def sanitize_sql_like(string, escape_character = "\\")
-        pattern = Regexp.union(escape_character, "%", "_")
-        string.gsub(pattern) { |x| [escape_character, x].join }
-      end
-
-      # Accepts an array of conditions. The array has each value
-      # sanitized and interpolated into the SQL statement.
-      #
-      #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
-      #   # => "name='foo''bar' and group_id=4"
-      #
-      #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
-      #   # => "name='foo''bar' and group_id=4"
-      #
-      #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
-      #   # => "name='foo''bar' and group_id='4'"
-      def sanitize_sql_array(ary)
-        statement, *values = ary
-        if values.first.is_a?(Hash) && statement =~ /:\w+/
-          replace_named_bind_variables(statement, values.first)
-        elsif statement.include?('?')
-          replace_bind_variables(statement, values)
-        elsif statement.blank?
-          statement
-        else
-          statement % values.collect { |value| connection.quote_string(value.to_s) }
+            "#{c.quote_table_name_for_assignment(table, attr)} = #{c.quote(value)}"
+          end.join(", ")
+        end
+
+        # Sanitizes a +string+ so that it is safe to use within an SQL
+        # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
+        #
+        #   sanitize_sql_like("100%")
+        #   # => "100\\%"
+        #
+        #   sanitize_sql_like("snake_cased_string")
+        #   # => "snake\\_cased\\_string"
+        #
+        #   sanitize_sql_like("100%", "!")
+        #   # => "100!%"
+        #
+        #   sanitize_sql_like("snake_cased_string", "!")
+        #   # => "snake!_cased!_string"
+        def sanitize_sql_like(string, escape_character = "\\") # :doc:
+          pattern = Regexp.union(escape_character, "%", "_")
+          string.gsub(pattern) { |x| [escape_character, x].join }
         end
-      end
-
-      def replace_bind_variables(statement, values) # :nodoc:
-        raise_if_bind_arity_mismatch(statement, statement.count('?'), values.size)
-        bound = values.dup
-        c = connection
-        statement.gsub(/\?/) do
-          replace_bind_variable(bound.shift, c)
+
+        # Accepts an array of conditions. The array has each value
+        # sanitized and interpolated into the SQL statement.
+        #
+        #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
+        #   # => "name='foo''bar' and group_id=4"
+        #
+        #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
+        #   # => "name='foo''bar' and group_id=4"
+        #
+        #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
+        #   # => "name='foo''bar' and group_id='4'"
+        def sanitize_sql_array(ary) # :doc:
+          statement, *values = ary
+          if values.first.is_a?(Hash) && /:\w+/.match?(statement)
+            replace_named_bind_variables(statement, values.first)
+          elsif statement.include?("?")
+            replace_bind_variables(statement, values)
+          elsif statement.blank?
+            statement
+          else
+            statement % values.collect { |value| connection.quote_string(value.to_s) }
+          end
         end
-      end
 
-      def replace_bind_variable(value, c = connection) # :nodoc:
-        if ActiveRecord::Relation === value
-          value.to_sql
-        else
-          quote_bound_value(value, c)
+        def replace_bind_variables(statement, values)
+          raise_if_bind_arity_mismatch(statement, statement.count("?"), values.size)
+          bound = values.dup
+          c = connection
+          statement.gsub(/\?/) do
+            replace_bind_variable(bound.shift, c)
+          end
         end
-      end
-
-      def replace_named_bind_variables(statement, bind_vars) # :nodoc:
-        statement.gsub(/(:?):([a-zA-Z]\w*)/) do |match|
-          if $1 == ':' # skip postgresql casts
-            match # return the whole match
-          elsif bind_vars.include?(match = $2.to_sym)
-            replace_bind_variable(bind_vars[match])
+
+        def replace_bind_variable(value, c = connection)
+          if ActiveRecord::Relation === value
+            value.to_sql
           else
-            raise PreparedStatementInvalid, "missing value for :#{match} in #{statement}"
+            quote_bound_value(value, c)
           end
         end
-      end
 
-      def quote_bound_value(value, c = connection) # :nodoc:
-        if value.respond_to?(:map) && !value.acts_like?(:string)
-          if value.respond_to?(:empty?) && value.empty?
-            c.quote(nil)
+        def replace_named_bind_variables(statement, bind_vars)
+          statement.gsub(/(:?):([a-zA-Z]\w*)/) do |match|
+            if $1 == ":" # skip postgresql casts
+              match # return the whole match
+            elsif bind_vars.include?(match = $2.to_sym)
+              replace_bind_variable(bind_vars[match])
+            else
+              raise PreparedStatementInvalid, "missing value for :#{match} in #{statement}"
+            end
+          end
+        end
+
+        def quote_bound_value(value, c = connection)
+          if value.respond_to?(:map) && !value.acts_like?(:string)
+            if value.respond_to?(:empty?) && value.empty?
+              c.quote(nil)
+            else
+              value.map { |v| c.quote(v) }.join(",")
+            end
           else
-            value.map { |v| c.quote(v) }.join(',')
+            c.quote(value)
           end
-        else
-          c.quote(value)
         end
-      end
 
-      def raise_if_bind_arity_mismatch(statement, expected, provided) # :nodoc:
-        unless expected == provided
-          raise PreparedStatementInvalid, "wrong number of bind variables (#{provided} for #{expected}) in: #{statement}"
+        def raise_if_bind_arity_mismatch(statement, expected, provided)
+          unless expected == provided
+            raise PreparedStatementInvalid, "wrong number of bind variables (#{provided} for #{expected}) in: #{statement}"
+          end
         end
-      end
     end
 
     # TODO: Deprecate this
     def quoted_id # :nodoc:
-      self.class.quote_value(@attributes[self.class.primary_key].value_for_database)
+      self.class.connection.quote(@attributes[self.class.primary_key].value_for_database)
     end
   end
 end