rails/arel — pull request #162 by dylanahsmith (2013-02-13 19:51:44+00:00)
Title: Quote integers to comparing a string column with integers.

## Problem

An equality with a string column and integer like

```sql
SELECT * FROM `users` WHERE `login_token` = 0 LIMIT 1;
```

will match any string that doesn't start with a digit in certain databases (including MySQL). However, Arel will simply treat Fixnum and Bignum as literals, and not give the connection an opportunity to quote these values.

See [Potential Query Manipulation with Common Rails Practises](https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU) for details on the potential security vulnerability.

## Solution

Arel should allow the connection to quote integers, but needs to provide the correct column type to avoid quoting integers like the argument to LIMIT.

Quoting the integer will avoid this potential security issue in a database independent way. So the above query can be quoted as follows and only match a login_token with the exact string `'0'`.

```sql
SELECT * FROM `users` WHERE `login_token` = '0' LIMIT 1;
```