> you'll also end up writing Ruby code to accomplish what the database is already capable of.
This is for the best. Usually, you have only a few database servers, while you have lots and lots of web servers. If you have a computationally intensive task, it's better to perform it on those web servers, which you can scale horizontally.
In our environment, the problem is usually the opposite -- it's way too easy in ActiveRecord to ask the database to do computation like sorting for you. Also, it can be hard to predict what impact an additional clause will have on the server's use of indexes. We try to get engineers new to Rails to write the simplest, most performant queries and then use ruby to do any soft of complicated transformation or computation.
Actually the right tool for this is plain old SQL. Even with nice formatting this is probably a 10-liner at most.
If you have a computationally intensive task, it's better to perform it on those web servers, which you can scale horizontally
It's only computationally intensive if you're doing it wrong.
When I post job adverts, a large portion of applicants balk at the SQL questions: "just use PDO, or ActiveRecord, or ADO, or SQLAlchemy". Which is fine, if they can explain the difference between inner, outer, left/right joins - and they can't. SQL will be the next COBOL at this rate, or at least I hope so for selfish and monetary reasons.
To make it a bit more clear, it's exactly the same separation of concerns that you want when you write a view for the UI. The controller takes one or more model objects and uses the view to generate an abstraction for the UI. When we save and fetch information from the DB (or send data out on the wire as JSON, for example) we want the exact same thing.
BTW, be very careful about doing all your computation on the ruby/rails side. It's a good idea from a certain perspective, but you are building a very nice bottleneck there if you have anything of real complexity. For example if you have a report that needs to sort through millions of records, you are going to be hanging your server for a loooong time. As you say, in those kinds of situations, you really want to query a service that has the ability to scale the requests more reasonably. Rails is incredibly poor at this kind of thing.
My own personal opinion is that there is very little that rails gives me that is worth the pain that Rails imposes. I'm much better off building something with Sinatra. What Rails does do very well (which the author also acknowledges) is reducing the number of things you need to know to get up and running quickly. But if you are going to pay the kind of salary I demand, then you will expect me to beyond that level ;-)
"Rails" is an appropriate term for the framework; step too far off of it, and you find you're on rocky terrain.
This solves the problem if you know ahead of time the format of the query, e.g. The example you gave would probably fit well. But if you're offering some kind of query building interface, well god help you.
No one has told me I'm wrong yet with this approach and it's been working great for years.
You just answered your own question. You sanitize the string and then you call connection.execute. Not sure I understand your other issue but it doesn't seem too compelling.
> Not sure I understand your other issue but it doesn't seem too compelling.
If you don't understand the other issue, how do you feel qualified to comment on whether it seems compelling?
Use case: I want to pull up a table of aggregated data for my user. The table is built by joining multiple tables together. The user can dynamically select which columns in the table he wants to see.
Model.find_by_sql(query, binds=[])
http://devdocs.io/rails~4.2/activerecord/querying#method-i-f...
Model.connection.select_all(query, name = nil, binds=[])
http://devdocs.io/rails~4.2/activerecord/connectionadapters/...
Oh, and if you're writing an INSERT statement you have to use connection.execute after all. Have fun!