File tree Expand file tree Collapse file tree 2 files changed +3
-3
lines changed Expand file tree Collapse file tree 2 files changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -470,12 +470,12 @@ class AdapterTimeout < QueryAborted
470470 #
471471 # For example, the following code would raise this exception:
472472 #
473- # Post.order("length (title) ").first
473+ # Post.order("REPLACE (title, 'misc', 'zzzz') asc ").pluck(:id)
474474 #
475475 # The desired result can be accomplished by wrapping the known-safe string
476476 # in Arel.sql:
477477 #
478- # Post.order(Arel.sql("length (title) ")).first
478+ # Post.order(Arel.sql("REPLACE (title, 'misc', 'zzzz') asc ")).pluck(:id)
479479 #
480480 # Again, such a workaround should *not* be used when passing user-provided
481481 # values, such as request parameters or model attributes to query methods.
Original file line number Diff line number Diff line change @@ -29,7 +29,7 @@ module Arel
2929
3030 # Wrap a known-safe SQL string for passing to query methods, e.g.
3131 #
32- # Post.order(Arel.sql("length (title) ")).last
32+ # Post.order(Arel.sql("REPLACE (title, 'misc', 'zzzz') asc ")).pluck(:id)
3333 #
3434 # Great caution should be taken to avoid SQL injection vulnerabilities.
3535 # This method should not be used with unsafe values such as request
You can’t perform that action at this time.
0 commit comments