Date values are not properly escaped in SQL output

I tried the following against Rails 3 (master)

OrderItem.where(:updated_at => Date.today..Date.yesterday)

and

OrderItem.find(:all, :conditions => {:updated_at => Date.today..Date.yesterday}) in 2.3.4

Both cases returned correctly escaped dates.

Should this be covered in activerecord/test/cases/sanitize_test perhaps? What version of rails are you using?

I cannot reproduce on 2.3.5 either.

What types are begin_date and end_date?

I reproduced this bug using rails3-beta1 and ruby 1.8.7, but it seems to have been resolved as of rails3-beta2.

@OP, what version of ruby/rails are you using?

Below is the schema and test:

Schema:

  create_table "tasks", :force => true do |t|

t.date     "start"
t.datetime "created_at"
t.datetime "updated_at"

  end

Test:

  test "escape date properly" do

(1..5).each do |i|
  Task.create!(:start => Date.today + i.days)
end
tasks = Task.find(:all, :conditions => {:start => Date.today..Date.today+2.days})
assert_operator tasks.length, :>=, 2

  end

Note: This test is not perfect. It simply takes advantage of the fact that when you execute the sql between without quoted dates Active Record returns an empty set.

This was an arel bug an is already fixed please try to reproduce things in the Rails master version and with the last arel

I'm using rails3.0.0-beta (presumably beta1) as stated in the release notes plus ruby 1.9.1p376.

Will try to update to rails from git and test again, thanks!

Ok, I checked with latest beta (Rails3.0.0.beta2) Arel 0.3.3
and now it works as expected.
The bug is RESOLVED! (I'm not able to change status)