BulkUpdatable: sanitize using connection.quote (#11)
BulkUpdatable: sanitize using connection.quote (#11)

`connection.quote` quotes the passed value appropriately to prevent SQL
injection attacks. We have been using `sanitize_sql_array` for the same
purpose, but that started to get weird when trying to handle array
columns, so once again I plumbed the depths of `activerecord-import` for
inspiration. `sanitize_sql_array` actually uses `connection.quote` deep
under the hood.

Hopefully this is easier to understand as well. I was having a hard time
tracking all the question marks and where things get inserted.

http://api.rubyonrails.org/classes/ActiveRecord/ConnectionAdapters/Quoting.html#method-i-quote
https://github.com/zdennis/activerecord-import/blob/master/lib/activerecord-import/import.rb#L868
https://github.com/rails/rails/blob/d15527800fbc199b969019c665226f836d8fedce/activerecord/lib/active_record/sanitization.rb#L198

An interesting learning over the course of this process is that
`activerecord-import` does not cast types using `::jsonb` or `::int` or
whatever. I was baffled how they could get away with this until I came
across this statement in the Postgres docs:

> When VALUES is used in INSERT, the values are all automatically
> coerced to the data type of the corresponding destination column. When
> it's used in other contexts, it might be necessary to specify the
> correct data type. If the entries are all quoted literal constants,
> coercing the first is sufficient to determine the assumed type for all

So basically, it's because Postgres casts automatically for `INSERT`
queries, but not other types of queries. Weird.

https://www.postgresql.org/docs/9.4/static/sql-values.html
mockdeep/junk_drawer,thread-pond/junk_drawer,mockdeep/junk_drawer,thread-pond/junk_drawer