# Just update 1 field

**URL:** <https://www.ruby-forum.com/t/just-update-1-field/52214>\
**Category:** Rails\
**Created:** [January 11, 2006, 11:43pm UTC](https://www.ruby-forum.com/t/just-update-1-field/52214 "2006-01-11T23:43:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mischa78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3da27b/32.png) [@mischa78](https://www.ruby-forum.com/u/mischa78)\
**Post date:** [January 11, 2006, 11:43pm UTC](https://www.ruby-forum.com/t/just-update-1-field/52214/1 "2006-01-11T23:43:57Z")

</div>

Hi All,

I wonder how I can get rails to update just one field when I do  
Myfile.save.

Right now this happens when I do a Myfile.save:

UPDATE myfiles SET `folder_id` = 0, `filesize` = 1, `data` =  
‘2f7573722f6c6f63616c2f6d … f7061636b65743d33324d’, `user_id` = 0,  
`date_modified` = ‘2006-01-11T23:33:57+0100’, `filename` =  
‘mysqlscripts.sql’ WHERE id = 4

but when just the filename has changed I’d rather see something like  
this:

UPDATE myfiles SET `filename` = ‘mysqlscripts.sql’ WHERE id = 4

Is this possible? How?

Thanks.

Mischa.

---

<div class="post-metadata">

**Author:** ![mischa78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3da27b/32.png) [@mischa78](https://www.ruby-forum.com/u/mischa78)\
**Post date:** [January 12, 2006, 12:35am UTC](https://www.ruby-forum.com/t/just-update-1-field/52214/2 "2006-01-12T00:35:30Z")

</div>

> UPDATE myfiles SET `filename` = ‘mysqlscripts.sql’ WHERE id = 4

OK, the way to do this is obviously:

myfiles = Myfile.find\_by\_sql("SELECT id, filename, date\_modified,  
folder\_id FROM myfiles WHERE id = " + @params[:id])

How do I prevent SQL injection when using find\_by\_sql? This doesn’t seem  
to work:

myfiles = Myfile.find\_by\_sql(“SELECT id, filename, date\_modified,  
folder\_id FROM myfiles WHERE id = ?”, @params[:id])

Thanks again!

---

<div class="post-metadata">

**Author:** ![mischa78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3da27b/32.png) [@mischa78](https://www.ruby-forum.com/u/mischa78)\
**Post date:** [January 12, 2006, 1:08am UTC](https://www.ruby-forum.com/t/just-update-1-field/52214/3 "2006-01-12T01:08:46Z")

</div>

Mischa B. wrote:

> Hi All,
> 
> I wonder how I can get rails to update just one field when I do  
> Myfile.save.

[http://api.rubyonrails.com/classes/ActiveRecord/Base.html#M000766](http://api.rubyonrails.com/classes/ActiveRecord/Base.html#M000766)

## As for SQL injection with find\_by\_sql, it follows the same convention as every other place where bound parameters are appropriate. Rather than passing multiple arguments you pass in one array, e.g., MyModel.find\_by\_sql([‘select \* from widgets where foo = ?’, @foo])

Jesse F. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
University of Chicago - NSIT Web Services  
AIM: farmerje  
Jabber: removed\_email\_address@domain.invalid  
Phone: (773)363-1058

---

<div class="post-metadata">

**Author:** ![mischa78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3da27b/32.png) [@mischa78](https://www.ruby-forum.com/u/mischa78)\
**Post date:** [January 12, 2006, 1:24am UTC](https://www.ruby-forum.com/t/just-update-1-field/52214/4 "2006-01-12T01:24:14Z")

</div>

Mischa B. wrote:

> I wonder how I can get rails to update just one field when I do  
> Myfile.save
> 
> but when just the filename has changed I’d rather see something like this:
> 
> UPDATE myfiles SET `filename` = ‘mysqlscripts.sql’ WHERE id = 4

Myfile.update\_all( “filename = ‘mysqlscripts.sql’”, ‘id = 4’ )

–  
We develop, watch us RoR, in numbers too big to ignore.