postgresql – 我可以获得Ecto来记录原始SQL吗？

from item in query,where:  like(item.description,^"%#{text}%")

我担心这允许在文本中注入SQL.在尝试修复之前,我想看看查询是如何实际发送到数据库的.

如果我inspect the query或查看记录的内容,我会看到一些SQL,但它无效.

例如,检查查询向我显示：

{"SELECT i0."id",i0."store_id",i0."title",i0."description" 
  FROM "items" AS i0 WHERE (i0."description" LIKE $1)",["%foo%"]}

当我将此查询传递给Repo.all时,它记录下来：

SELECT i0."id",i0."store_id",i0."title",i0."description"
  FROM "items" AS i0 WHERE (i0."description" LIKE $1) ["%foo%"]

但如果我将其复制并粘贴到psql中,PostgreSQL会给我一个错误：

ERROR: 42P02: there is no parameter $1

似乎Ecto实际上可能正在做parameterized query,如下所示：

PREPARE bydesc(text) AS SELECT i0."id",i0."description" 
  FROM "items" AS i0 WHERE (i0."description" LIKE $1);
EXECUTE bydesc('foo');

如果是这样,我认为这会阻止SQL注入.但我只是猜测这就是Ecto的作用.

如何查看Ecto正在执行的实际SQL？