t27duck/duck_chain — pull request #3 by ambisoft (2013-09-13 10:33:52+00:00)
Title: column names moved to prepared statement strings in AR conditions

I've experienced problems when executing name_gt() conditions with the where('? > ?', col, val) implementation - having records with, say, amount 0, the calls like where('? > ?', 'amount', 0) would return records with 0 amounts. I double-checked that it was not related to values being set to NULL in the database. And the behavior was inconsistent when using different databases (sqlite3, mysql)

This version seems to always work fine. And since the 'column names' here are really derived from the class attributes, it should be safe to include them directly in the strings without having to extra escape/quote.