Doctrine, escape variable field name in DQL - sql

I have a DQL query like:
$em->createQuery("
SELECT r
FROM WeAdminBundle:FamilyRelation r
WHERE r.col like :query
")
Now I want to change "col" depending on various parameters. How can i achieve this with DQL since the normal setParameter doesn't work here.

You can use setParameter with DQL, as many examples are provided but for LIKE clauses, make sure the variable is wrapped in %.
$em->createQuery("
SELECT r
FROM WeAdminBundle:FamilyRelation r
WHERE r.col like :query
")->setParameters(array(
'query' => '%'.$foo.'%'
))

In short: you can't the way you want it.
To do it you'd need something like $dql->setColumn(array('variable_column' => 'some_column_name')) just as the bindColumn method from PDO, but there's no equivalent method (bindColum or setcolumn) in Doctrine.

For use of different parameter instead of col please see below example:
$var = "r.col";
Here you can change based on condition.
$em->createQuery("
SELECT r
FROM WeAdminBundle:FamilyRelation r
WHERE ".$var." like :query
")
please have a look it.

Related

Codeigniter database queries with multiple LIKE parameters

How can I perform a query with multiple LIKE parameters?
For example, I have this string to search through:
"I like searching very much"
This is the code I currently use:
$searTerm = "like"
$this->db->or_like('list.description', $SearchTerm,'both');
But i want to search with 2 or 3 parameters. like this:
$searTerm = "like"
$searTerm1 = "much"
How can i perform this to get the same result?
You can simply repeat the like parameters on the active record. In your example you would do something like this:
$this->db->or_like('list.description', $searchTerm1);
$this->db->or_like('list.description', $searchTerm2);
$this->db->or_like('list.description', $searchTerm3);
...
This will just join each or_like with an AND in the WHERE clause.
Firstly, you need to define the array with like variables then, its very important to put the or_like statement above the where clause in order to make multiple 'OR' statements for like 'AND' the where clause.
Here is example:
$this->db->or_like(array('column_name1' => $k, 'column_name2' => $k))
$this->db->where($whereColumn, $whereValue)
You can use like group
$this->db->group_start()->like('column_name1', $value)
->or_group_start()
->like('column_name2', $value)
->group_end()
->group_end();

? in ActiveRecord select

In a where statement, you can use variables like:
Order.where('employee_id = ?', params[:employee_id])
I'm trying to accomplish something similar with a select, but it's not working:
Order.select('amount FROM line_items WHERE employee_id = ? AS employee_line_items', params[:employee_id])
=> ERROR: syntax error at or near "1"
=> LINE 1: ...ployee_id" = ? AS employee_line_items, 1
What's going on here? Is it possible to use ? in select statement? If not, how can you insert an escaped sql string here? I'd like to just use #{params[:employee_id]}, but this bit of code would be vulnerable to sql injection.
You have to split your query and chain it:
Order.select('amount FROM line_items').where(['WHERE employee_id = ?', params[:employee_id]])
And also based on this question, I believe you cannot use AS in WHERE clause, only when selecting fields (and you can't use them in WHERE in any case)
Check the documentation to understand how select works on ActiveRecord models

SQL and search in many column

My sql in rails
#search = #search.where('txt_1 OR txt_2 OR keywords like ?', some_value)
Why this doesn't work. When I have only " txt_1 OR txt_2 " - i think it works ok. But when I add next OR, there is no result when some_value doesn't exist in last OR.
ANSWER:
ok as I see, OR is condition that return true for one OR/AND second variable. I make this like that, and it works - I don't know is this a good solution
#items.where(' (txt_1 OR txt_2 like ?) OR (keywords like ?) ', "%#{search_name}%","%#{search_name}%")
The OR statement in SQL has to be used to compare different assertion, like something = 'something' OR other_thing = 'other_stuff'.
In your case, you should use the OR keyword as the following:
#items.where('txt_1 LIKE ? OR txt_2 LIKE ? OR keywords LIKE ?', "%#{search_name}%","%#{search_name}%", "%#{search_name}%")
But since you use the same value (search_name), you can use this pretty usefull syntax:
#items.where('txt_1 LIKE :search OR txt_2 LIKE :search OR keywords LIKE :search', search: "%#{search_name}%")

How to specify multiple values in where with AR query interface in rails3

Per section 2.2 of rails guide on Active Record query interface here:
which seems to indicate that I can pass a string specifying the condition(s), then an array of values that should be substituted at some point while the arel is being built. So I've got a statement that generates my conditions string, which can be a varying number of attributes chained together with either AND or OR between them, and I pass in an array as the second arg to the where method, and I get:
ActiveRecord::PreparedStatementInvalid: wrong number of bind variables (1 for 5)
which leads me to believe I'm doing this incorrectly. However, I'm not finding anything on how to do it correctly. To restate the problem another way, I need to pass in a string to the where method such as "table.attribute = ? AND table.attribute1 = ? OR table.attribute1 = ?" with an unknown number of these conditions anded or ored together, and then pass something, what I thought would be an array as the second argument that would be used to substitute the values in the first argument conditions string. Is this the correct approach, or, I'm just missing some other huge concept somewhere and I'm coming at this all wrong? I'd think that somehow, this has to be possible, short of just generating a raw sql string.
This is actually pretty simple:
Model.where(attribute: [value1,value2])
Sounds like you're doing something like this:
Model.where("attribute = ? OR attribute2 = ?", [value, value])
Whereas you need to do this:
# notice the lack of an array as the last argument
Model.where("attribute = ? OR attribute2 = ?", value, value)
Have a look at http://guides.rubyonrails.org/active_record_querying.html#array-conditions for more details on how this works.
Instead of passing the same parameter multiple times to where() like this
User.where(
"first_name like ? or last_name like ? or city like ?",
"%#{search}%", "%#{search}%", "%#{search}%"
)
you can easily provide a hash
User.where(
"first_name like :search or last_name like :search or city like :search",
{search: "%#{search}%"}
)
that makes your query much more readable for long argument lists.
Sounds like you're doing something like this:
Model.where("attribute = ? OR attribute2 = ?", [value, value])
Whereas you need to do this:
#notice the lack of an array as the last argument
Model.where("attribute = ? OR attribute2 = ?", value, value) Have a
look at
http://guides.rubyonrails.org/active_record_querying.html#array-conditions
for more details on how this works.
Was really close. You can turn an array into a list of arguments with *my_list.
Model.where("id = ? OR id = ?", *["1", "2"])
OR
params = ["1", "2"]
Model.where("id = ? OR id = ?", *params)
Should work
If you want to chain together an open-ended list of conditions (attribute names and values), I would suggest using an arel table.
It's a bit hard to give specifics since your question is so vague, so I'll just explain how to do this for a simple case of a Post model and a few attributes, say title, summary, and user_id (i.e. a user has_many posts).
First, get the arel table for the model:
table = Post.arel_table
Then, start building your predicate (which you will eventually use to create an SQL query):
relation = table[:title].eq("Foo")
relation = relation.or(table[:summary].eq("A post about foo"))
relation = relation.and(table[:user_id].eq(5))
Here, table[:title], table[:summary] and table[:user_id] are representations of columns in the posts table. When you call table[:title].eq("Foo"), you are creating a predicate, roughly equivalent to a find condition (get all rows whose title column equals "Foo"). These predicates can be chained together with and and or.
When your aggregate predicate is ready, you can get the result with:
Post.where(relation)
which will generate the SQL:
SELECT "posts".* FROM "posts"
WHERE (("posts"."title" = "Foo" OR "posts"."summary" = "A post about foo")
AND "posts"."user_id" = 5)
This will get you all posts that have either the title "Foo" or the summary "A post about foo", and which belong to a user with id 5.
Notice the way arel predicates can be endlessly chained together to create more and more complex queries. This means that if you have (say) a hash of attribute/value pairs, and some way of knowing whether to use AND or OR on each of them, you can loop through them one by one and build up your condition:
relation = table[:title].eq("Foo")
hash.each do |attr, value|
relation = relation.and(table[attr].eq(value))
# or relation = relation.or(table[attr].eq(value)) for an OR predicate
end
Post.where(relation)
Aside from the ease of chaining conditions, another advantage of arel tables is that they are independent of database, so you don't have to worry whether your MySQL query will work in PostgreSQL, etc.
Here's a Railscast with more on arel: http://railscasts.com/episodes/215-advanced-queries-in-rails-3?view=asciicast
Hope that helps.
You can use a hash rather than a string. Build up a hash with however many conditions and corresponding values you are going to have and put it into the first argument of the where method.
WRONG
This is what I used to do for some reason.
keys = params[:search].split(',').map!(&:downcase)
# keys are now ['brooklyn', 'queens']
query = 'lower(city) LIKE ?'
if keys.size > 1
# I need something like this depending on number of keys
# 'lower(city) LIKE ? OR lower(city) LIKE ? OR lower(city) LIKE ?'
query_array = []
keys.size.times { query_array << query }
#['lower(city) LIKE ?','lower(city) LIKE ?']
query = query_array.join(' OR ')
# which gives me 'lower(city) LIKE ? OR lower(city) LIKE ?'
end
# now I can query my model
# if keys size is one then keys are just 'brooklyn',
# in this case it is 'brooklyn', 'queens'
# #posts = Post.where('lower(city) LIKE ? OR lower(city) LIKE ?','brooklyn', 'queens' )
#posts = Post.where(query, *keys )
now however - yes - it's very simple. as nfriend21 mentioned
Model.where(attribute: [value1,value2])
does the same thing

what does positional and named parameter in a query mean?

here we got a positional parameter:
SELECT
u
FROM ForumUser u
WHERE u.id = ?1
and here a named parameter:
SELECT
u
FROM ForumUser u
WHERE u.username = :name
this is DQL (doctrine query language) but i think the concept is the same.
could someone please explain what these mean and do?
A positional parameter is set by its index in the clause.
A named parameter is set by its name.
When you are setting the values, you might have the values in an array, in which case the positional form could me more useful. Alternatively, you might have them in an associative array by name, in which case the named form is more useful.
Update - Although the documentation refers to positional parameters as for example ?1, the examples just use ?.
This example of positional parameters maps values by position in the array provided into the positional placeholders in the query.
$q = Doctrine_Query::create()
->from('User u')
->where('u.username = ? and u.age = ?', array('Arnold', 50));
$users = $q->fetchArray();
However this example maps values by name in an associative array to their named placeholders. See how they do not need tgo be in order.
$q = Doctrine_Query::create()
->from('User u')
->where('u.username = :username and u.age = :age',
array(':age' => 50, ':username' => 'Arnold'));
(Have to admit I'm not a PHP guy - above based on the examples here.)
Positional parameters are specified by their order in the query. Named parameters are specified by their names.
When using positional parameters you have to add them in the same order that they are used in the query, and if you want to use the same value more than once you have to add it multiple times as separate parameters.
When using names parameters you can add them in any order you want, and a parameter can be used more than once in the query.
For example if you have a query that searches in several fields, using positional parameters it could look like this:
select u.UserId, u.UserName
from FormumUser u
where u.UserName like ? or u.Email like ? or u.Address like ?
You would have to add the search string three times as separate parameters. Using names parameters it could look like:
select u.UserId, u.UserName
from FormumUser u
where u.UserName like #find or u.Email like #find or u.Address like #find
Then you would only add one parameter, as the query can use the same parameter in three places.
(The exact syntax for using the parameters in the query of course varies depending on what database solution you are using.)
I don't kown if I Understood right, so this is what I think:
Positional parameters should be indexed using an integer index, and named parameters should be accessed though their names.
Example (this is pseudocode):
query.SetParameter(0, 456); // here we set value 456 to the first parameter, which has index zero
query.SetParameter("username", "John Smith"); // here we set value "John Smith" to the parameter named "username"