activerecord 7.0.0 → 7.1.2

data/lib/active_record/relation/spawn_methods.rb

@@ -6,7 +6,6 @@ require "active_record/relation/merger"
 
 module ActiveRecord
   module SpawnMethods
-    # This is overridden by Associations::CollectionProxy
     def spawn # :nodoc:
       already_in_scope?(klass.scope_registry) ? klass.all : clone
     end
@@ -28,6 +27,9 @@ module ActiveRecord
     #   # => Post.where(published: true).joins(:comments)
     #
     # This is mainly intended for sharing common conditions between multiple associations.
+    #
+    # For conditions that exist in both relations, those from <tt>other</tt> will take precedence.
+    # To find the intersection of two relations, use QueryMethods#and.
     def merge(other, *rest)
       if other.is_a?(Array)
         records & other
@@ -40,6 +42,21 @@ module ActiveRecord
 
     def merge!(other, *rest) # :nodoc:
       options = rest.extract_options!
+
+      if options.key?(:rewhere)
+        if options[:rewhere]
+          ActiveRecord.deprecator.warn(<<-MSG.squish)
+            Specifying `Relation#merge(rewhere: true)` is deprecated, as that has now been
+            the default since Rails 7.0. Setting the rewhere option will error in Rails 7.2
+          MSG
+        else
+          ActiveRecord.deprecator.warn(<<-MSG.squish)
+            `Relation#merge(rewhere: false)` is deprecated without replacement,
+            and will be removed in Rails 7.2
+          MSG
+        end
+      end
+
       if other.is_a?(Hash)
         Relation::HashMerger.new(self, other, options[:rewhere]).merge
       elsif other.is_a?(Relation)

data/lib/active_record/relation.rb

@@ -5,13 +5,14 @@ module ActiveRecord
   class Relation
     MULTI_VALUE_METHODS  = [:includes, :eager_load, :preload, :select, :group,
                             :order, :joins, :left_outer_joins, :references,
-                            :extending, :unscope, :optimizer_hints, :annotate]
+                            :extending, :unscope, :optimizer_hints, :annotate,
+                            :with]
 
     SINGLE_VALUE_METHODS = [:limit, :offset, :lock, :readonly, :reordering, :strict_loading,
                             :reverse_order, :distinct, :create_with, :skip_query_cache]
 
     CLAUSE_METHODS = [:where, :having, :from]
-    INVALID_METHODS_FOR_DELETE_ALL = [:distinct]
+    INVALID_METHODS_FOR_DELETE_ALL = [:distinct, :with]
 
     VALUE_METHODS = MULTI_VALUE_METHODS + SINGLE_VALUE_METHODS + CLAUSE_METHODS
 
@@ -33,6 +34,8 @@ module ActiveRecord
       @delegate_to_klass = false
       @future_result = nil
       @records = nil
+      @async = false
+      @none = false
     end
 
     def initialize_copy(other)
@@ -43,7 +46,7 @@ module ActiveRecord
     def bind_attribute(name, value) # :nodoc:
       if reflection = klass._reflect_on_association(name)
         name = reflection.foreign_key
-        value = value.read_attribute(reflection.klass.primary_key) unless value.nil?
+        value = value.read_attribute(reflection.association_primary_key) unless value.nil?
       end
 
       attr = table[name]
@@ -159,21 +162,25 @@ module ActiveRecord
     # failed due to validation errors it won't be persisted, you get what
     # #create returns in such situation.
     #
-    # Please note <b>this method is not atomic</b>, it runs first a SELECT, and if
-    # there are no results an INSERT is attempted. If there are other threads
-    # or processes there is a race condition between both calls and it could
-    # be the case that you end up with two similar records.
+    # If creation failed because of a unique constraint, this method will
+    # assume it encountered a race condition and will try finding the record
+    # once more If somehow the second find still find no record because a
+    # concurrent DELETE happened, it will then raise an
+    # ActiveRecord::RecordNotFound exception.
     #
-    # If this might be a problem for your application, please see #create_or_find_by.
+    # Please note <b>this method is not atomic</b>, it runs first a SELECT,
+    # and if there are no results an INSERT is attempted. So if the table
+    # doesn't have a relevant unique constraint it could be the case that
+    # you end up with two or more similar records.
     def find_or_create_by(attributes, &block)
-      find_by(attributes) || create(attributes, &block)
+      find_by(attributes) || create_or_find_by(attributes, &block)
     end
 
     # Like #find_or_create_by, but calls
     # {create!}[rdoc-ref:Persistence::ClassMethods#create!] so an exception
     # is raised if the created record is invalid.
     def find_or_create_by!(attributes, &block)
-      find_by(attributes) || create!(attributes, &block)
+      find_by(attributes) || create_or_find_by!(attributes, &block)
     end
 
     # Attempts to create a record with the given attributes in a table that has a unique database constraint
@@ -181,16 +188,15 @@ module ActiveRecord
     # unique constraints, the exception such an insertion would normally raise is caught,
     # and the existing record with those attributes is found using #find_by!.
     #
-    # This is similar to #find_or_create_by, but avoids the problem of stale reads between the SELECT
-    # and the INSERT, as that method needs to first query the table, then attempt to insert a row
-    # if none is found.
+    # This is similar to #find_or_create_by, but tries to create the record first. As such it is
+    # better suited for cases where the record is most likely not to exist yet.
     #
     # There are several drawbacks to #create_or_find_by, though:
     #
     # * The underlying table must have the relevant columns defined with unique database constraints.
     # * A unique constraint violation may be triggered by only one, or at least less than all,
     #   of the given attributes. This means that the subsequent #find_by! may fail to find a
-    #   matching record, which will then raise an <tt>ActiveRecord::RecordNotFound</tt> exception,
+    #   matching record, which will then raise an ActiveRecord::RecordNotFound exception,
     #   rather than a record with the given attributes.
     # * While we avoid the race condition between SELECT -> INSERT from #find_or_create_by,
     #   we actually have another race condition between INSERT -> SELECT, which can be triggered
@@ -199,7 +205,7 @@ module ActiveRecord
     # * It relies on exception handling to handle control flow, which may be marginally slower.
     # * The primary key may auto-increment on each create, even if it fails. This can accelerate
     #   the problem of running out of integers, if the underlying table is still stuck on a primary
-    #   key of type int (note: All Rails apps since 5.1+ have defaulted to bigint, which is not liable
+    #   key of type int (note: All \Rails apps since 5.1+ have defaulted to bigint, which is not liable
     #   to this problem).
     #
     # This method will return a record if all given attributes are covered by unique constraints
@@ -209,7 +215,11 @@ module ActiveRecord
     def create_or_find_by(attributes, &block)
       transaction(requires_new: true) { create(attributes, &block) }
     rescue ActiveRecord::RecordNotUnique
-      find_by!(attributes)
+      if connection.transaction_open?
+        where(attributes).lock.find_by!(attributes)
+      else
+        find_by!(attributes)
+      end
     end
 
     # Like #create_or_find_by, but calls
@@ -218,7 +228,11 @@ module ActiveRecord
     def create_or_find_by!(attributes, &block)
       transaction(requires_new: true) { create!(attributes, &block) }
     rescue ActiveRecord::RecordNotUnique
-      find_by!(attributes)
+      if connection.transaction_open?
+        where(attributes).lock.find_by!(attributes)
+      else
+        find_by!(attributes)
+      end
     end
 
     # Like #find_or_create_by, but calls {new}[rdoc-ref:Core#new]
@@ -236,8 +250,8 @@ module ActiveRecord
     #
     # Please see further details in the
     # {Active Record Query Interface guide}[https://guides.rubyonrails.org/active_record_querying.html#running-explain].
-    def explain
-      exec_explain(collecting_queries_for_explain { exec_queries })
+    def explain(*options)
+      exec_explain(collecting_queries_for_explain { exec_queries }, options)
     end
 
     # Converts relation objects to Array.
@@ -267,6 +281,8 @@ module ActiveRecord
 
     # Returns true if there are no records.
     def empty?
+      return true if @none
+
       if loaded?
         records.empty?
       else
@@ -275,26 +291,34 @@ module ActiveRecord
     end
 
     # Returns true if there are no records.
-    def none?
-      return super if block_given?
+    def none?(*args)
+      return true if @none
+
+      return super if args.present? || block_given?
       empty?
     end
 
     # Returns true if there are any records.
-    def any?
-      return super if block_given?
+    def any?(*args)
+      return false if @none
+
+      return super if args.present? || block_given?
       !empty?
     end
 
     # Returns true if there is exactly one record.
-    def one?
-      return super if block_given?
+    def one?(*args)
+      return false if @none
+
+      return super if args.present? || block_given?
       return records.one? if loaded?
       limited_count == 1
     end
 
     # Returns true if there is more than one record.
     def many?
+      return false if @none
+
       return super if block_given?
       return records.many? if loaded?
       limited_count > 1
@@ -307,7 +331,7 @@ module ActiveRecord
     #    # => "products/query-1850ab3d302391b85b8693e941286659"
     #
     # If ActiveRecord::Base.collection_cache_versioning is turned off, as it was
-    # in Rails 6.0 and earlier, the cache key will also include a version.
+    # in \Rails 6.0 and earlier, the cache key will also include a version.
     #
     #    ActiveRecord::Base.collection_cache_versioning = false
     #    Product.where("name like ?", "%Cosmic Encounter%").cache_key
@@ -388,7 +412,7 @@ module ActiveRecord
       end
 
       if timestamp
-        "#{size}-#{timestamp.utc.to_formatted_s(cache_timestamp_format)}"
+        "#{size}-#{timestamp.utc.to_fs(cache_timestamp_format)}"
       else
         "#{size}"
       end
@@ -409,7 +433,7 @@ module ActiveRecord
     #   Comment.where(post_id: 1).scoping do
     #     Comment.first
     #   end
-    #   # => SELECT "comments".* FROM "comments" WHERE "comments"."post_id" = 1 ORDER BY "comments"."id" ASC LIMIT 1
+    #   # SELECT "comments".* FROM "comments" WHERE "comments"."post_id" = 1 ORDER BY "comments"."id" ASC LIMIT 1
     #
     # If <tt>all_queries: true</tt> is passed, scoping will apply to all queries
     # for the relation including +update+ and +delete+ on instances.
@@ -429,10 +453,10 @@ module ActiveRecord
       end
     end
 
-    def _exec_scope(*args, &block) # :nodoc:
+    def _exec_scope(...) # :nodoc:
       @delegate_to_klass = true
       registry = klass.scope_registry
-      _scoping(nil, registry) { instance_exec(*args, &block) || self }
+      _scoping(nil, registry) { instance_exec(...) || self }
     ensure
       @delegate_to_klass = false
     end
@@ -446,7 +470,8 @@ module ActiveRecord
     #
     # ==== Parameters
     #
-    # * +updates+ - A string, array, or hash representing the SET part of an SQL statement.
+    # * +updates+ - A string, array, or hash representing the SET part of an SQL statement. Any strings provided will
+    #   be type cast, unless you use +Arel.sql+. (Don't pass user-provided values to +Arel.sql+.)
     #
     # ==== Examples
     #
@@ -461,9 +486,14 @@ module ActiveRecord
     #
     #   # Update all invoices and set the number column to its id value.
     #   Invoice.update_all('number = id')
+    #
+    #   # Update all books with 'Rails' in their title
+    #   Book.where('title LIKE ?', '%Rails%').update_all(title: Arel.sql("title + ' - volume 1'"))
     def update_all(updates)
       raise ArgumentError, "Empty list of attributes to change" if updates.blank?
 
+      return 0 if @none
+
       if updates.is_a?(Hash)
         if klass.locking_enabled? &&
             !updates.key?(klass.locking_column) &&
@@ -599,6 +629,8 @@ module ActiveRecord
     #   Post.distinct.delete_all
     #   # => ActiveRecord::ActiveRecordError: delete_all doesn't support distinct
     def delete_all
+      return 0 if @none
+
       invalid_methods = INVALID_METHODS_FOR_DELETE_ALL.select do |method|
         value = @values[method]
         method == :distinct ? value : value&.any?
@@ -646,6 +678,21 @@ module ActiveRecord
     # Schedule the query to be performed from a background thread pool.
     #
     #   Post.where(published: true).load_async # => #<ActiveRecord::Relation>
+    #
+    # When the +Relation+ is iterated, if the background query wasn't executed yet,
+    # it will be performed by the foreground thread.
+    #
+    # Note that {config.active_record.async_query_executor}[https://guides.rubyonrails.org/configuring.html#config-active-record-async-query-executor] must be configured
+    # for queries to actually be executed concurrently. Otherwise it defaults to
+    # executing them in the foreground.
+    #
+    # +load_async+ will also fall back to executing in the foreground in the test environment when transactional
+    # fixtures are enabled.
+    #
+    # If the query was actually executed in the background, the Active Record logs will show
+    # it by prefixing the log line with <tt>ASYNC</tt>:
+    #
+    #   ASYNC Post Load (0.0ms) (db time 2ms)  SELECT "posts".* FROM "posts" LIMIT 100
     def load_async
       return load if !connection.async_enabled?
 
@@ -697,6 +744,7 @@ module ActiveRecord
       @to_sql = @arel = @loaded = @should_eager_load = nil
       @offsets = @take = nil
       @cache_keys = nil
+      @cache_versions = nil
       @records = nil
       self
     end
@@ -704,7 +752,7 @@ module ActiveRecord
     # Returns sql statement for the relation.
     #
     #   User.where(name: 'Oscar').to_sql
-    #   # => SELECT "users".* FROM "users"  WHERE "users"."name" = 'Oscar'
+    #   # SELECT "users".* FROM "users"  WHERE "users"."name" = 'Oscar'
     def to_sql
       @to_sql ||= if eager_loading?
         apply_join_dependency do |relation, join_dependency|
@@ -721,7 +769,7 @@ module ActiveRecord
     #
     #   User.where(name: 'Oscar').where_values_hash
     #   # => {name: "Oscar"}
-    def where_values_hash(relation_table_name = klass.table_name)
+    def where_values_hash(relation_table_name = klass.table_name) # :nodoc:
       where_clause.to_h(relation_table_name)
     end
 
@@ -741,7 +789,7 @@ module ActiveRecord
     # Joins that are also marked for preloading. In which case we should just eager load them.
     # Note that this is a naive implementation because we could have strings and symbols which
     # represent the same association, but that aren't matched by this. Also, we could have
-    # nested hashes which partially match, e.g. { a: :b } & { a: [:b, :c] }
+    # nested hashes which partially match, e.g. <tt>{ a: :b } & { a: [:b, :c] }</tt>
     def joined_includes_values
       includes_values & joins_values
     end
@@ -758,8 +806,13 @@ module ActiveRecord
       end
     end
 
-    def pretty_print(q)
-      q.pp(records)
+    def pretty_print(pp)
+      subject = loaded? ? records : annotate("loading for pp")
+      entries = subject.take([limit_value, 11].compact.min)
+
+      entries[10] = "..." if entries.size == 11
+
+      pp.pp(entries)
     end
 
     # Returns true if relation is blank.
@@ -821,10 +874,6 @@ module ActiveRecord
         @loaded = true
       end
 
-      def null_relation? # :nodoc:
-        is_a?(NullRelation)
-      end
-
     private
       def already_in_scope?(registry)
         @delegate_to_klass && registry.current_scope(klass, true)
@@ -902,13 +951,21 @@ module ActiveRecord
           preload_associations(records) unless skip_preloading_value
 
           records.each(&:readonly!) if readonly_value
-          records.each(&:strict_loading!) if strict_loading_value
+          records.each { |record| record.strict_loading!(strict_loading_value) } unless strict_loading_value.nil?
 
           records
         end
       end
 
       def exec_main_query(async: false)
+        if @none
+          if async
+            return Promise::Complete.new([])
+          else
+            return []
+          end
+        end
+
         skip_query_cache_if_necessary do
           if where_clause.contradiction?
             [].freeze

data/lib/active_record/result.rb

@@ -2,6 +2,8 @@
 
 module ActiveRecord
   ###
+  # = Active Record \Result
+  #
   # This class encapsulates a result returned from calling
   # {#exec_query}[rdoc-ref:ConnectionAdapters::DatabaseStatements#exec_query]
   # on any database connection adapter. For example:
@@ -36,8 +38,12 @@ module ActiveRecord
 
     attr_reader :columns, :rows, :column_types
 
-    def self.empty # :nodoc:
-      EMPTY
+    def self.empty(async: false) # :nodoc:
+      if async
+        EMPTY_ASYNC
+      else
+        EMPTY
+      end
     end
 
     def initialize(columns, rows, column_types = {})
@@ -47,9 +53,6 @@ module ActiveRecord
       @column_types = column_types
     end
 
-    EMPTY = new([].freeze, [].freeze, {}.freeze)
-    private_constant :EMPTY
-
     # Returns true if this result set includes the column named +name+
     def includes_column?(name)
       @columns.include? name
@@ -108,7 +111,7 @@ module ActiveRecord
         type = if type_overrides.is_a?(Array)
           type_overrides.first
         else
-          column_type(columns.first, type_overrides)
+          column_type(columns.first, 0, type_overrides)
         end
 
         rows.map do |(value)|
@@ -118,7 +121,7 @@ module ActiveRecord
         types = if type_overrides.is_a?(Array)
           type_overrides
         else
-          columns.map { |name| column_type(name, type_overrides) }
+          columns.map.with_index { |name, i| column_type(name, i, type_overrides) }
         end
 
         rows.map do |values|
@@ -134,10 +137,17 @@ module ActiveRecord
       @hash_rows    = nil
     end
 
+    def freeze # :nodoc:
+      hash_rows.freeze
+      super
+    end
+
     private
-      def column_type(name, type_overrides = {})
+      def column_type(name, index, type_overrides)
         type_overrides.fetch(name) do
-          column_types.fetch(name, Type.default_value)
+          column_types.fetch(index) do
+            column_types.fetch(name, Type.default_value)
+          end
         end
       end
 
@@ -181,5 +191,11 @@ module ActiveRecord
             }
           end
       end
+
+      EMPTY = new([].freeze, [].freeze, {}.freeze).freeze
+      private_constant :EMPTY
+
+      EMPTY_ASYNC = FutureResult::Complete.new(EMPTY).freeze
+      private_constant :EMPTY_ASYNC
   end
 end

data/lib/active_record/runtime_registry.rb

@@ -10,11 +10,20 @@ module ActiveRecord
     extend self
 
     def sql_runtime
-      ActiveSupport::IsolatedExecutionState[:active_record_sql_runtime]
+      ActiveSupport::IsolatedExecutionState[:active_record_sql_runtime] ||= 0.0
     end
 
     def sql_runtime=(runtime)
       ActiveSupport::IsolatedExecutionState[:active_record_sql_runtime] = runtime
     end
+
+    def reset
+      rt, self.sql_runtime = sql_runtime, 0.0
+      rt
+    end
   end
 end
+
+ActiveSupport::Notifications.monotonic_subscribe("sql.active_record") do |name, start, finish, id, payload|
+  ActiveRecord::RuntimeRegistry.sql_runtime += (finish - start) * 1_000.0
+end

data/lib/active_record/sanitization.rb

@@ -5,8 +5,8 @@ module ActiveRecord
     extend ActiveSupport::Concern
 
     module ClassMethods
-      # Accepts an array or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for a WHERE clause.
+      # Accepts an array of SQL conditions and sanitizes them into a valid
+      # SQL fragment for a WHERE clause.
       #
       #   sanitize_sql_for_conditions(["name=? and group_id=?", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id=4"
@@ -17,8 +17,19 @@ module ActiveRecord
       #   sanitize_sql_for_conditions(["name='%s' and group_id='%s'", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id='4'"
       #
+      # This method will NOT sanitize a SQL string since it won't contain
+      # any conditions in it and will return the string as is.
+      #
       #   sanitize_sql_for_conditions("name='foo''bar' and group_id='4'")
       #   # => "name='foo''bar' and group_id='4'"
+      #
+      # Note that this sanitization method is not schema-aware, hence won't do any type casting
+      # and will directly use the database adapter's +quote+ method.
+      # For MySQL specifically this means that numeric parameters will be quoted as strings
+      # to prevent query manipulation attacks.
+      #
+      #   sanitize_sql_for_conditions(["role = ?", 0])
+      #   # => "role = '0'"
       def sanitize_sql_for_conditions(condition)
         return nil if condition.blank?
 
@@ -29,8 +40,8 @@ module ActiveRecord
       end
       alias :sanitize_sql :sanitize_sql_for_conditions
 
-      # Accepts an array, hash, or string of SQL conditions and sanitizes
-      # them into a valid SQL fragment for a SET clause.
+      # Accepts an array or hash of SQL conditions and sanitizes them into
+      # a valid SQL fragment for a SET clause.
       #
       #   sanitize_sql_for_assignment(["name=? and group_id=?", nil, 4])
       #   # => "name=NULL and group_id=4"
@@ -41,8 +52,19 @@ module ActiveRecord
       #   Post.sanitize_sql_for_assignment({ name: nil, group_id: 4 })
       #   # => "`posts`.`name` = NULL, `posts`.`group_id` = 4"
       #
+      # This method will NOT sanitize a SQL string since it won't contain
+      # any conditions in it and will return the string as is.
+      #
       #   sanitize_sql_for_assignment("name=NULL and group_id='4'")
       #   # => "name=NULL and group_id='4'"
+      #
+      # Note that this sanitization method is not schema-aware, hence won't do any type casting
+      # and will directly use the database adapter's +quote+ method.
+      # For MySQL specifically this means that numeric parameters will be quoted as strings
+      # to prevent query manipulation attacks.
+      #
+      #   sanitize_sql_for_assignment(["role = ?", 0])
+      #   # => "role = '0'"
       def sanitize_sql_for_assignment(assignments, default_table_name = table_name)
         case assignments
         when Array; sanitize_sql_array(assignments)
@@ -92,26 +114,32 @@ module ActiveRecord
       end
 
       # Sanitizes a +string+ so that it is safe to use within an SQL
-      # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%".
+      # LIKE statement. This method uses +escape_character+ to escape all
+      # occurrences of itself, "_" and "%".
       #
-      #   sanitize_sql_like("100%")
-      #   # => "100\\%"
+      #   sanitize_sql_like("100% true!")
+      #   # => "100\\% true!"
       #
       #   sanitize_sql_like("snake_cased_string")
       #   # => "snake\\_cased\\_string"
       #
-      #   sanitize_sql_like("100%", "!")
-      #   # => "100!%"
+      #   sanitize_sql_like("100% true!", "!")
+      #   # => "100!% true!!"
       #
       #   sanitize_sql_like("snake_cased_string", "!")
       #   # => "snake!_cased!_string"
       def sanitize_sql_like(string, escape_character = "\\")
-        pattern = Regexp.union(escape_character, "%", "_")
-        string.gsub(pattern) { |x| [escape_character, x].join }
+        if string.include?(escape_character) && escape_character != "%" && escape_character != "_"
+          string = string.gsub(escape_character, '\0\0')
+        end
+
+        string.gsub(/(?=[%_])/, escape_character)
       end
 
       # Accepts an array of conditions. The array has each value
-      # sanitized and interpolated into the SQL statement.
+      # sanitized and interpolated into the SQL statement. If using named bind
+      # variables in SQL statements where a colon is required verbatim use a
+      # backslash to escape.
       #
       #   sanitize_sql_array(["name=? and group_id=?", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id=4"
@@ -119,8 +147,19 @@ module ActiveRecord
       #   sanitize_sql_array(["name=:name and group_id=:group_id", name: "foo'bar", group_id: 4])
       #   # => "name='foo''bar' and group_id=4"
       #
+      #   sanitize_sql_array(["TO_TIMESTAMP(:date, 'YYYY/MM/DD HH12\\:MI\\:SS')", date: "foo"])
+      #   # => "TO_TIMESTAMP('foo', 'YYYY/MM/DD HH12:MI:SS')"
+      #
       #   sanitize_sql_array(["name='%s' and group_id='%s'", "foo'bar", 4])
       #   # => "name='foo''bar' and group_id='4'"
+      #
+      # Note that this sanitization method is not schema-aware, hence won't do any type casting
+      # and will directly use the database adapter's +quote+ method.
+      # For MySQL specifically this means that numeric parameters will be quoted as strings
+      # to prevent query manipulation attacks.
+      #
+      #   sanitize_sql_array(["role = ?", 0])
+      #   # => "role = '0'"
       def sanitize_sql_array(ary)
         statement, *values = ary
         if values.first.is_a?(Hash) && /:\w+/.match?(statement)
@@ -172,9 +211,11 @@ module ActiveRecord
         end
 
         def replace_named_bind_variables(statement, bind_vars)
-          statement.gsub(/(:?):([a-zA-Z]\w*)/) do |match|
+          statement.gsub(/([:\\]?):([a-zA-Z]\w*)/) do |match|
             if $1 == ":" # skip postgresql casts
               match # return the whole match
+            elsif $1 == "\\" # escaped literal colon
+              match[1..-1] # return match with escaping backlash char removed
             elsif bind_vars.include?(match = $2.to_sym)
               replace_bind_variable(bind_vars[match])
             else
@@ -187,13 +228,13 @@ module ActiveRecord
           if value.respond_to?(:map) && !value.acts_like?(:string)
             values = value.map { |v| v.respond_to?(:id_for_database) ? v.id_for_database : v }
             if values.empty?
-              c.quote_bound_value(nil)
+              c.quote(c.cast_bound_value(nil))
             else
-              values.map! { |v| c.quote_bound_value(v) }.join(",")
+              values.map! { |v| c.quote(c.cast_bound_value(v)) }.join(",")
             end
           else
             value = value.id_for_database if value.respond_to?(:id_for_database)
-            c.quote_bound_value(value)
+            c.quote(c.cast_bound_value(value))
           end
         end