# ActiveRecord.create using Mysql builtin methods?

**URL:** <https://www.ruby-forum.com/t/activerecord-create-using-mysql-builtin-methods/165259>\
**Category:** Rails\
**Created:** [April 10, 2009, 11:07pm UTC](https://www.ruby-forum.com/t/activerecord-create-using-mysql-builtin-methods/165259 "2009-04-10T23:07:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dawillis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ebca7d/32.png) [@dawillis](https://www.ruby-forum.com/u/dawillis)\
**Post date:** [April 10, 2009, 11:07pm UTC](https://www.ruby-forum.com/t/activerecord-create-using-mysql-builtin-methods/165259/1 "2009-04-10T23:07:15Z")

</div>

Hello,

Basically, I need to do an insert such as:

create(  
‘user\_id’ =\> “#{uid}”,  
‘cre\_date’ =\> ‘date\_add(now(), interval 12 hour)’,  
‘expire\_date’ =\> ‘now()’,  
‘upd\_date’ =\> ‘now()’  
)

where, date\_add() and now() are executed (‘populated’) server side.

I can accomplish the insert, low level with:  
a = ActiveRecord::Base.connection.insert(“INSERT into sess (user\_id,  
cre\_date, expire\_date, upd\_date) VALUES (”#{uid}", now(),  
date\_add(now(), interval 12 hour), now())");

but that is less than ideal (sql injection comes to mind)

Is there a ‘standard’ way to do this with ActiveRecord? (or a way to  
accomplish the insert ‘safely’ (without duplicating the work or arg  
validation))

(Note: I am using a legacy database schema, not an activerecord created  
database)

Thanks

---

<div class="post-metadata">

**Author:** ![dawillis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ebca7d/32.png) [@dawillis](https://www.ruby-forum.com/u/dawillis)\
**Post date:** [April 10, 2009, 11:23pm UTC](https://www.ruby-forum.com/t/activerecord-create-using-mysql-builtin-methods/165259/2 "2009-04-10T23:23:54Z")

</div>

On 10 Apr 2009, at 22:07, David W. wrote:

> )  
> Is there a ‘standard’ way to do this with ActiveRecord? (or a way to  
> accomplish the insert ‘safely’ (without duplicating the work or arg  
> validation))
> 
> (Note: I am using a legacy database schema, not an activerecord  
> created  
> database)

I’d use the sanitize\_sql methods in activerecord to do the escaping  
stuff. AR in general doesn’t leave much up to the database.

Fred