This will allow all types which require no additional handling to use
prepared statements. Specifically, this will allow for `true`, `false`,
`Date`, `Time`, and any custom PG type to use prepared statements. This
also revealed another source of nil columns in bind params, and an
inconsistency in their use.

The specific inconsistency comes from a nested query coming from a
through association, where one of the inversed associations is not
bi-directional.

The stop-gap is to simply construct the column at the site it is being
used. This should simply go away on its own once we use `Attribute` to
represent them instead, since we already have all of the information we
need.

This is to help facilitate future refactorings, as the internal
representation is changed. I'm planning on having `where_values` return
an array that's computed on call, which means that mutation will have no
affect. This is the only remaining place that was mutating (tested by
replacing the method with calling `dup`)

With the old implementation, the bind values were created, and then we
search the attributes for `Relation` objects, and merge them. This
completely ignores the order that the actual `where` clause will use. If
all non-relation where parameters are before the relations, it will
work. However, if we query on both a relation and a value, with the
value coming second, it breaks. The order of the hash should not affect
the final query (especially since hashes being ordered is an
implementation detail)

I'm looking to introduce a `WhereClause` class to handle most of this
logic, and this method will eventually move over to there. However, this
intermediate refactoring should make that easier to do.

Looking through the blame, this logic used to be when we actually
created the bind tuple. My guess is that `nil` couldn't be handled there
at that time. It can, now.

In order to better facilitate refactoring, most places that mutated
`bind_values` have already been removed. One last spot snuck through.
Since we're no longer mutating the array, it also does not need to be
duped in `initialize_copy`.

This is cropping up all over the place. After a brief dive, I'm really
not sure why we have `arel.bind_values` at all. A cursory grep didn't
reveal where they're actually being assigned (it's definitely in AR, not
in Arel). I'd like to dig further into it, as I'm fairly certain we
don't actually need it, we just need a way for the predicate builder to
communicate merged binds upstream.

Fixes #18414

This adresses https://github.com/rails/rails/commit/1b7aa62b184c4410c99208f71b59bbac5c5f03be#commitcomment-9147803

This commit fixes the following case.

    User.where(User.arel_table[:created_at].lteq(1.year.ago)).unscope(where :created_at)

`where_sql` now requires that we pass it an engine. None of the manager
classes take an engine in their constructor.

We never actually make use of it on the table, since we're constructing
the select manager manually. It looks like if we ever actually were
grabbing it from the table, we're grossly misusing it since it's meant
to vary by AR class.

Its existence on `Arel::Table` appears to be purely for convenience
methods that are never used outside of tests. However, in production
code it just complicates construction of the tables on the rails side,
and the plan is to remove it from `Arel::Table` entirely. I'm not
convinced it needs to live on `SelectManager`, etc either.

on the joined assoiciation

Arel handles this for us automatically. Updated tests, as BindParam is
no longer a subclass of SqlLiteral. We should remove the second argument
to substitute_at entirely, as it's no longer used

We need to re-order the bind parameters since the AST returned by the
relation will have the where statement as the first bp, which breaks on
PG.

In practical terms, this allows serialized columns and tz aware columns
to be used in wheres that go through joins, where they previously would
not behave correctly. Internally, this removes 1/3 of the cases where we
rely on Arel to perform type casting for us.

There were two non-obvious changes required for this. `update_all` on
relation was merging its bind values with arel's in the wrong order.
Additionally, through associations were assuming there would be no bind
parameters in the preloader (presumably because the where would always
be part of a join)

[Melanie Gilman & Sean Griffin]

We end up re-ordering them either way when we construct the Arel AST (in order
to deal with rewhere, etc), so we shouldn't bother giving it a number in the
first place beforehand.

The current style for warning messages without newlines uses
concatenation of string literals with manual trailing spaces
where needed.

Heredocs have better readability, and with `squish` we can still
produce a single line.

This is a similar use case to the one that motivated defining
`strip_heredoc`, heredocs are super clean.

[Matthew Draper & Yves Senn]

Closes #16860. (pull request to discuss the implementation)

Using heredoc would enforce line wrapping to whatever column width we decided to
use in the code, making it difficult for the users to read on some consoles.

This does make the source code read slightly worse and a bit more error-prone,
but this seems like a fair price to pay since the primary purpose for these
messages are for the users to read and the code will not stick around for too
long.

If the request parameters are passed to create_with and where they can
be used to do mass assignment when used in combination with
Relation#create.

Fixes CVE-2014-3514

Conflicts:
	activerecord/lib/active_record/relation/query_methods.rb

Example:

  Author.where(posts: { author_id: Author.where(country_id: 1) }).joins(:posts)

It seems that #where! is not designed to be used as a chained where.
See initial implementation at 8c2c6051.
So, no need to check twice.

We should not test #where!

https://github.com/rails/rails/pull/15285#discussion_r13018316

/cc @tenderlove

Fixes #14752

Select mimics the block interface of arrays, but does not mock the
block interface for select!. This change moves the api to be a
private method, _select!.

The reverse_order method was using a flag to control if the order should
be reversed or not. Instead of using this variable just build the reverse order
inside its proper method.

This implementation was leading to an unexpected behavior when using
reverse_order and then applying reorder(nil).

Example:
  Before
    Post.order(:name).reverse_order.reorder(nil)
    # => SELECT "posts".* FROM "posts"   ORDER BY "posts"."id" DESC

  After
    Post.order(:name).reverse_order.reorder(nil)
   # => SELECT "posts".* FROM "posts"

The group method also takes an array, however this isn't immediately
clear by reading the source since it delegates this method. If you
trace it back to the AREL building you can see that it does support
an array.

Shoutout to @betovelandia for pointing this out.

Closes #14406.

origin: https://github.com/rails/rails/commit/f6aeb8b1a3687c8523e4a56309fe3736011b2935#commitcomment-5569649

This is a result of the discussion at https://github.com/rails/rails/pull/14263/files#r10291489

This behavior has almost no performance impact:

String not allowed  66.910000   0.030000  66.940000 ( 67.024976)
String allowed      69.360000   0.030000  69.390000 ( 69.503096)

Benchmarked with http://git.io/Y0YuRw.