[B! activerecord] kic-yuukiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kic-yuuki id:kic-yuuki

activerecordã«é–¢ã™ã‚‹kic-yuukiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Railsã®migrationã§change_columnã‚’åˆ©ç”¨ã™ã‚‹ - hotoolong's blog
change_column change_column_null change_column_comment change_column_default change_column Railsã®migrationã§ã‚«ãƒ©ãƒ ã®æƒ…å ±ã‚’å¤‰æ›´ã—ãŸã„å ´åˆã«ã‚ˆãä½¿ã†change_columnã§ã™ãŒã€ change_column(table_name, column_name, type, options = {}) ã¨å¤‰æ›´ã—ãŸã„typeã‚’è¨å®šã—ã¦optionsã‚’è¨å®šã™ã‚Œã°ã„ã„ã®ã§ã€add_columnãªã©ã¨ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ã‚¤ã‚¹ãŒå¤‰ã‚ã‚‰ãšè¨å®šã§ãã¾ã™ã€‚ change_column_null NULLã®true/falseã‚’åˆ‡ã‚Šæ›¿ãˆãŸã„ã ã‘ã®å ´åˆã¯ change_column_nullãŒä¾¿åˆ©ã§ã™ãã€‚ change_column_null(:users, :nickname, false) ã“ã®ã‚ˆã†ã«è¨å®šã§ãã¾ã™
kic-yuuki 2019/06/17
ã‚³ãƒ¡ãƒ³ãƒˆå¤‰æ›´ã¯change_column_commentã‚’ä½¿ãˆã°ã‚ˆã„ã®ã‹ã€æ„Ÿè¬

Rails

ActiveRecord
ãƒªãƒ³ã‚¯
Rails/Model(Active Record)ã®Tips
Active Recordã§ç™ºè¡Œã™ã‚‹ã‚¯ã‚¨ãƒªã«é–¢ã™ã‚‹Tipsã‚’ã„ãã¤ã‹ç´¹ä»‹ã—ã¾ã™ã€‚ ðŸ˜Ž likeå¥ã®ã‚µãƒ‹ã‚¿ã‚¤ã‚ºï¼šsanitize_sql_likelikeå¥ã®æ¤œç´¢ãƒ¯ãƒ¼ãƒ‰ã¯ã‚µãƒ‹ã‚¿ã‚¤ã‚ºã‚’å¿˜ã‚Œã¦ã—ã¾ã„ãŒã¡ã§ã™ã€‚ãã“ã§ã‚µãƒ‹ã‚¿ã‚¤ã‚ºã‚’ã™ã‚‹sanitize_sql_likeã‚’ä½¿ã†ã¹ãã§ã™ã€‚ # Likeå¥ã®æ¤œç´¢ãƒ¯ãƒ¼ãƒ‰ã®ã‚µãƒ‹ã‚¿ã‚¤ã‚ºãŒã•ã‚Œã¦ã„ãªã„ Hogehoge.where('name LIKE ?', "%#{sanitize_sql_like(params[:name])}%")
kic-yuuki 2019/03/07
activerecordã®likeå¥ç”¨ã«ã‚µãƒ‹ã‚¿ã‚¤ã‚ºãƒ¡ã‚½ãƒƒãƒ‰ãŒç”¨æ„ã•ã‚Œã¦ã„ãŸã®ã‹ `sanitize_sql_like`

rails

activerecord
ãƒªãƒ³ã‚¯
Rails SQL Injection Examples
Overview The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not inclu
kic-yuuki 2019/03/07
ã“ã“ãŒå‡ºå…¸

activerecord

rails
ãƒªãƒ³ã‚¯
ActiveRecordã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãƒ‘ã‚¿ãƒ¼ãƒ³
(Last Updated On: 2018å¹´10æœˆ7æ—¥)Railsã§å¤šç”¨ã•ã‚Œã¦ã„ã‚‹ActiveRecordã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’ç°¡å˜ã«ç´¹ä»‹ã—ã¾ã™ã€‚å‡ºå…¸ã¯rails-sqli.orgãªã®ã§ã‚ˆã‚Šè©³ã—ã„è§£èª¬ã¯ã“ã¡ã‚‰ã§ç¢ºèªã—ã¦ãã ã•ã„ã€‚ç‰¹ã«æ°—ã‚’ã¤ã‘ã‚‹å¿…è¦ãŒã‚ã‚‹ã¨æ€ã‚ã‚Œã‚‹ç‰©ã®ã¿ã‚’ãƒ”ãƒƒã‚¯ã‚¢ãƒƒãƒ—ã—ã¾ã—ãŸã€‚ Exists?ãƒ¡ã‚½ãƒƒãƒ‰ User.exists? params[:user] params[:user]ãªã©ã®ä½¿ã„æ–¹ã¯å±é™ºã§ã™ã€‚Railsã¯PHPãªã©ã¨åŒæ§˜ã«user[]ã¨ã„ã†ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ãƒ¼ã§é…åˆ—åŒ–ã—ã¾ã™ã€‚ ?user[]=1 ãŒå…¥åŠ›ã®å ´åˆã€ SELECT 1 AS one FROM "users" WHERE (1) LIMIT 1 ã¨ãªã‚Šä¸æ£ãªã‚¯ã‚¨ãƒªãŒå®Ÿè¡Œã•ã‚Œã¾ã™ã€‚ Calculateãƒ¡ã‚½ãƒƒãƒ‰ Calculateãƒ¡ã‚½ãƒƒãƒ‰ã¯SQLã®é›†ç´„é–¢æ•°ã‚’å®Ÿè¡Œã™ã‚‹ãƒ¡ã‚½ãƒƒãƒ‰ã§ã™ã€‚averageã€calcula
kic-yuuki 2019/03/07
å‚è€ƒã«ã™ã‚‹

rails

activerecord
ãƒªãƒ³ã‚¯
1