diff --git a/activerecord/lib/active_record/errors.rb b/activerecord/lib/active_record/errors.rb index 2e8d3e800c..c8e4fe8612 100644 --- a/activerecord/lib/active_record/errors.rb +++ b/activerecord/lib/active_record/errors.rb @@ -470,12 +470,12 @@ module ActiveRecord # # For example, the following code would raise this exception: # - # Post.order("length(title)").first + # Post.order("REPLACE(title, 'misc', 'zzzz') asc").pluck(:id) # # The desired result can be accomplished by wrapping the known-safe string # in Arel.sql: # - # Post.order(Arel.sql("length(title)")).first + # Post.order(Arel.sql("REPLACE(title, 'misc', 'zzzz') asc")).pluck(:id) # # Again, such a workaround should *not* be used when passing user-provided # values, such as request parameters or model attributes to query methods. diff --git a/activerecord/lib/arel.rb b/activerecord/lib/arel.rb index 148508461c..bb84d272ab 100644 --- a/activerecord/lib/arel.rb +++ b/activerecord/lib/arel.rb @@ -29,7 +29,7 @@ module Arel # Wrap a known-safe SQL string for passing to query methods, e.g. # - # Post.order(Arel.sql("length(title)")).last + # Post.order(Arel.sql("REPLACE(title, 'misc', 'zzzz') asc")).pluck(:id) # # Great caution should be taken to avoid SQL injection vulnerabilities. # This method should not be used with unsafe values such as request