To avoid SQL injection, we use a parameterized query with ActiveRecord, such as:
House.where("year_built > ?", 2000)
which works great (the example above is not optimal, because it could just as well be House.where(year_built: [2000..]) but it’s just for context).
However, when using a JSON column, there’s a problem, the value passed to WHERE is always converted to a string, e.g. “2000” instead of 2000. This won’t work:
House.where("data->'$.year_built' > ?", 2000)
WHERE (data->'$.yearBuilt' > '2000')" won’t find any result as we’re comparing integer to string.
Is there a way to force the parameterized query in Rails to cast ? to a number always?
7