TabDigital/squel — pull request #3 by waterytowers (2014-10-01 04:22:34+00:00)
Title: [bugfix/toParam-nested] nesting query inside where and expr clause and t...

...oParam

There were some issues with nesting a query inside a where clause and the use of toParam. The nested queries were being converted to a string rather than doing a toParam, the string result was being added as the value for the parameter. This is a potential sql injection risk.

Now the nested/inline query when provided as a parameter will be in a where clause will replace the parameter '?' with the textual component of the nested query, and add any parameters from the nested query to the parent query.

Example,

subqry = squel.select().field('col3').from('table2').where('col5 = ?', 'test1')
query = squel.select().field('col1').from('table1').where('col2 in ?', subqry)

query.toParam() gives:

{ text: "SELECT col1 FROM table1 WHERE (col2 IN (SELECT col3 FROM table2 WHERE (col5 = ?)))",
values: ['test1']
}

Previously it gave:

{ text: "SELECT col1 FROM table1 WHERE (col2 IN (?))",
values: ['SELECT col3 FROM table2 WHERE (col5 = 'test1')']
}