# Creating an escaped JOIN?

**URL:** <https://www.ruby-forum.com/t/creating-an-escaped-join/151820>\
**Category:** Rails\
**Created:** [October 26, 2008, 10:21am UTC](https://www.ruby-forum.com/t/creating-an-escaped-join/151820 "2008-10-26T10:21:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 26, 2008, 10:21am UTC](https://www.ruby-forum.com/t/creating-an-escaped-join/151820/1 "2008-10-26T10:21:14Z")

</div>

Hi,

When creating a custom find for a model, with AR it is possible to do  
something like:

:conditions =\> [‘user\_id = ?’, params[:id]]

However, I would like to know if it is possible to do the same when  
specifying a JOIN:

:joins =\> [‘LEFT OUTER JOIN orders ON (items.order\_id = orders.id AND  
orders.user\_id = ?’, params[:id]]

I tried the above expression, but unfortunately, Rails didn’t replace  
the question mark with its escaped value.

Any idea if this is possible? I need to move some filtering from the  
WHERE clause into the ON clause and have it all escaped.

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 26, 2008, 2:38pm UTC](https://www.ruby-forum.com/t/creating-an-escaped-join/151820/2 "2008-10-26T14:38:23Z")

</div>

On Sun, Oct 26, 2008 at 10:21 AM, Fernando P.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> :joins =\> [‘LEFT OUTER JOIN orders ON (items.order\_id = orders.id AND  
> orders.user\_id = ?’, params[:id]]

Placeholders are not supported there indeed.

You cannot work with regular AR association API calls right? For  
example:

# untested

user = User.find(params[:id])  
items = user.orders.map(&:items).flatten.uniq

or say:

# untested

items = Item.all(  
:conditions =\> {‘users.id’ =\> params[:id]},  
:joins =\> {:order =\> :user}  
)

If not, you can still extract an integer from params[:id] and safely  
interpolate. That’s easy with Integer() or #to\_i.

– fxn

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 26, 2008, 2:46pm UTC](https://www.ruby-forum.com/t/creating-an-escaped-join/151820/3 "2008-10-26T14:46:34Z")

</div>

On Oct 26, 1:37 pm, “Xavier N.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> # untested
> 
> If not, you can still extract an integer from params[:id] and safely  
> interpolate. That’s easy with Integer() or #to\_i.

and more generally the connection object’s quote method (and variants)  
are useful. See also the sanitize\_sql method.

Fred

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 26, 2008, 2:49pm UTC](https://www.ruby-forum.com/t/creating-an-escaped-join/151820/4 "2008-10-26T14:49:00Z")

</div>

Hi Fred,

sanitize\_sql is the way to go, then I simply evaluate what it spits me  
out inside my :joins value.

Regards,