Question

I know about prepared statements, but if I’m using raw SQL, does ActiveRecord have a way to manually escape values?

Something like this would be nice:

self.escape("O'Malley") # O\'Malley

Answer 1

You can do:

Dude.connection.quote("O'Malley")

result: "'O''Malley'"

---

NOTE: Once upon a time you could do

Dude.sanitize("O'Malley")

but that’s been deprecated, and the current method

Dude.sanitize_sql("O'Malley")

does not escape apostrophes.