rails/rails — Issue #3382: A "." in the string literal causes this query to choke
Author: nasa42
Created: 2011-10-20 21:07:16+00:00
State: open

Steps to reproduce

```bash
$ rails new garbage --skip-bundle #Rails 3.1.1
$ cd garbage
$ echo "gem 'johnson'" >> Gemfile
$ bundle
$ rails g model Post
$ rails g model Label name:string post_id:integer
$ bundle exec rake db:migrate
$ echo "class Post < ActiveRecord::Base; has_many :labels; end" > app/models/post.rb
$ echo "class Label < ActiveRecord::Base; belongs_to :post; end" > app/models/label.rb
$ rails c
```

```bash
> #This expression completely loves Ruby
> Label.where(:name => 'ruby').includes(:post => :labels).order(:post_id)
Label Load (0.1ms) SELECT "labels".* FROM "labels" WHERE "labels"."name" = 'ruby' ORDER BY post_id
=> []

> #No tender lovemaking for Node.js though
> Label.where(:name => 'node.js').includes(:post => :labels).order(:post_id)
SQL (0.2ms) SELECT "labels"."id" AS t0_r0, "labels"."name" AS t0_r1, "labels"."post_id" AS t0_r2, "labels"."created_at" AS t0_r3, "labels"."updated_at" AS t0_r4, "posts"."id" AS t1_r0, "posts"."created_at" AS t1_r1, "posts"."updated_at" AS t1_r2, "labels_posts"."id" AS t2_r0, "labels_posts"."name" AS t2_r1, "labels_posts"."post_id" AS t2_r2, "labels_posts"."created_at" AS t2_r3, "labels_posts"."updated_at" AS t2_r4 FROM "labels" LEFT OUTER JOIN "posts" ON "posts"."id" = "labels"."post_id" LEFT OUTER JOIN "labels" "labels_posts" ON "labels_posts"."post_id" = "posts"."id" WHERE "labels"."name" = 'node.js' ORDER BY post_id
SQLite3::SQLException: ambiguous column name: post_id: SELECT "labels"."id" AS t0_r0, "labels"."name" AS t0_r1, "labels"."post_id" AS t0_r2, "labels"."created_at" AS t0_r3, "labels"."updated_at" AS t0_r4, "posts"."id" AS t1_r0, "posts"."created_at" AS t1_r1, "posts"."updated_at" AS t1_r2, "labels_posts"."id" AS t2_r0, "labels_posts"."name" AS t2_r1, "labels_posts"."post_id" AS t2_r2, "labels_posts"."created_at" AS t2_r3, "labels_posts"."updated_at" AS t2_r4 FROM "labels" LEFT OUTER JOIN "posts" ON "posts"."id" = "labels"."post_id" LEFT OUTER JOIN "labels" "labels_posts" ON "labels_posts"."post_id" = "posts"."id" WHERE "labels"."name" = 'node.js' ORDER BY post_id
ActiveRecord::StatementInvalid: SQLite3::SQLException: ambiguous column name: post_id: SELECT "labels"."id" AS t0_r0, "labels"."name" AS t0_r1, "labels"."post_id" AS t0_r2, "labels"."created_at" AS t0_r3, "labels"."updated_at" AS t0_r4, "posts"."id" AS t1_r0, "posts"."created_at" AS t1_r1, "posts"."updated_at" AS t1_r2, "labels_posts"."id" AS t2_r0, "labels_posts"."name" AS t2_r1, "labels_posts"."post_id" AS t2_r2, "labels_posts"."created_at" AS t2_r3, "labels_posts"."updated_at" AS t2_r4 FROM "labels" LEFT OUTER JOIN "posts" ON "posts"."id" = "labels"."post_id" LEFT OUTER JOIN "labels" "labels_posts" ON "labels_posts"."post_id" = "posts"."id" WHERE "labels"."name" = 'node.js' ORDER BY post_id
from /usr/lib/ruby/gems/1.8/gems/sqlite3-1.3.4/lib/sqlite3/database.rb:91:in `initialize'
from /usr/lib/ruby/gems/1.8/gems/sqlite3-1.3.4/lib/sqlite3/database.rb:91:in `new'
from /usr/lib/ruby/gems/1.8/gems/sqlite3-1.3.4/lib/sqlite3/database.rb:91:in `prepare'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/sqlite_adapter.rb:227:in `exec_query'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/abstract_adapter.rb:244:in `log'
from /usr/lib/ruby/gems/1.8/gems/activesupport-3.1.1/lib/active_support/notifications/instrumenter.rb:21:in `instrument'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/abstract_adapter.rb:239:in `log'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/sqlite_adapter.rb:223:in `exec_query'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/sqlite_adapter.rb:434:in `select'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/abstract/database_statements.rb:18:in `select_all'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/connection_adapters/abstract/query_cache.rb:63:in `select_all'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/relation/finder_methods.rb:211:in `find_with_associations'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/relation.rb:111:in `to_a'
from /usr/lib/ruby/gems/1.8/gems/activerecord-3.1.1/lib/active_record/relation.rb:436:in `inspect'
from /usr/lib/ruby/1.8/irb.rb:310:in `output_value'
from /usr/lib/ruby/1.8/irb.rb:159:in `eval_input'
from /usr/lib/ruby/1.8/irb.rb:271:in `signal_status'
from /usr/lib/ruby/1.8/irb.rb:155:in `eval_input'
from /usr/lib/ruby/1.8/irb.rb:154:in `eval_input'
from /usr/lib/ruby/1.8/irb.rb:71:in `start'
from /usr/lib/ruby/1.8/irb.rb:70:in `catch'
from /usr/lib/ruby/1.8/irb.rb:70:in `start'
from /usr/lib/ruby/gems/1.8/gems/railties-3.1.1/lib/rails/commands/console.rb:45:in `start'
from /usr/lib/ruby/gems/1.8/gems/railties-3.1.1/lib/rails/commands/console.rb:8:in `start'
from /usr/lib/ruby/gems/1.8/gems/railties-3.1.1/lib/rails/commands.rb:40
from script/rails:6:in `require'
from script/rails:6
```

**Notice** how drastically the query syntax is changed because of a `.` in the name.
I know these queries may look stupid and unreasonable, but these are just dumbed down versions.

P.S. Could this also have some sort of security implications, as Rails is behaving differently because of a special character in a user supplied input which is supposed to be sanitised?