David

[Ruby] On ActiveRecord find_by_sql

2010-01-18T21:24:53-08:00

I thought that the ["?", var] pattern protected from sql injection like it says in the docs, no?

## From railsguides [ruby]
# But in SQL fragments, especially in conditions fragments (:conditions => "..."), the connection.execute()
# or Model.find_by_sql() methods, it has to be applied manually. Instead of passing a string to the conditions
# option, you can pass an array to sanitize tainted strings like this:

Model.find(:first, :conditions => ["login = ? AND password = ?", entered_user_name, entered_password])

# As you can see, the first part of the array is an SQL fragment with question marks. The sanitized versions
# of the variables in the second part of the array replace the question marks. Or you can pass a hash for the same result:

[Ruby] On ActiveRecord find_by_sql

2010-01-18T16:10:42-08:00

Thanks. Updated now.

[Ruby] ActiveRecord find_by_sql

2010-01-17T20:52:15-08:00

How can I turn this into something more activerecordish? I might want to add another condition into that query, like limiting the search to clips after a specific date.

Clip.find_by_sql(["select * from clips where not exists
        (select 'clip_id' from histories where histories.clip_id = clips.id
        and histories.user_id = ?) ORDER BY clips.created_at DESC LIMIT 20", user.id])