Rails 4中的SQL INSERT INTO SELECT语句通过connection.execute

Question

ActiveRecord::Base.connection.execute("INSERT INTO order_items (cart_id, quantity, product_id) SELECT cart_id, quantity, product_id FROM cart_items WHERE cart_id = ? ", cart_id)

我在控制器操作中运行上述代码以在表之间转移数据。

终端显示以下代码正在执行

nqjeV4HNx5So4Zx2x-81qg (9.3ms)  INSERT INTO order_items (cart_id, quantity, product_id) SELECT cart_id, quantity, product_id FROM cart_items WHERE cart_id = ? 

即使代码运行时没有引发任何错误，也不会将数据从 CartItem 模型移动到 OrderItem 模型。请让我知道我做错了什么。

我正在根据以下代码示例对我的查询进行建模：http://www.w3schools.com/sql/sql_insert_into_select.asp

Answer 1

ActiveRecord::Base.connection.execute("INSERT INTO order_items (cart_id, quantity, product_id) SELECT cart_id, quantity, product_id FROM cart_items WHERE cart_id = ? ", cart_id)

execute 方法不允许这种带有问号和红宝石变量的插值技术。该方法的第一个参数应该是一个完整的 SQL 查询。你应该这样做：

"... WHERE cart_id = '#{cart_id}'"

但这很危险，因为它允许 SQL 注入。在插入 cart_id 变量之前，您应该确保它只包含数字。

其实这里你不需要使用纯SQL查询，因为你可以使用ActiveRecord来达到你的目的：

ActiveRecord::Base.transaction do
  CartItem.where(cart_id: cart_id).each do |cart_item|
    OrderItem.create(cart_id: cart_item.cart_id, quantity: cart_item.quantity, product_id: cart_item.product_id)
  end
end

或者你可以使用https://github.com/zdennis/activerecord-importgem：

cart_items = CartItem.where(cart_id: cart_id).pluck(:cart_id, :quantity, :product_id)
OrderItem.import([:cart_id, :quantity, :product_id], cart_items)