# About the sql injection

**URL:** <https://www.ruby-forum.com/t/about-the-sql-injection/132070>\
**Category:** Rails\
**Created:** [March 16, 2008, 12:24pm UTC](https://www.ruby-forum.com/t/about-the-sql-injection/132070 "2008-03-16T12:24:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vincent.Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/90db22/32.png) [@Vincent.Z](https://www.ruby-forum.com/u/Vincent.Z)\
**Post date:** [March 16, 2008, 12:24pm UTC](https://www.ruby-forum.com/t/about-the-sql-injection/132070/1 "2008-03-16T12:24:51Z")

</div>

the “agile web development with rails” book advocate the bind variable  
facility,

that is :

subject = params[:subject]  
Email.find(:all,  
:conditions =\> [“owner\_id = 123 AND subject = ?” , subject])

i have some questions about this,

if i dont assign the params hash to one variable,is it ok to protect  
the injection?

such as:

1. Email.find(:all,  
:conditions =\> [ “owner\_id = 123 AND subject = ?” ,  
params[:subject] ])

and how about this one:

1. Email.find(:all,  
:conditions =\>{“owner\_id = 123 AND subject = :subject”,  
[:subject=\>params[:subject]]})

thanks!

---

<div class="post-metadata">

**Author:** ![Vincent.Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/90db22/32.png) [@Vincent.Z](https://www.ruby-forum.com/u/Vincent.Z)\
**Post date:** [March 16, 2008, 3:16pm UTC](https://www.ruby-forum.com/t/about-the-sql-injection/132070/2 "2008-03-16T15:16:29Z")

</div>

Vincent.Z wrote:

> if i dont assign the params hash to one variable,is it ok to protect  
> the injection?
> 
> such as:
> 
> 1. Email.find(:all,  
> :conditions =\> [ “owner\_id = 123 AND subject = ?” ,  
> params[:subject] ])

Perfectly fine at the code level. The ? cannot see where that value came  
from;  
it’s just one more argument to find().

However, while certain Rails coders tend to revel in long unclear lines,  
you  
should not. You should add variables with names that reveal intent, and  
should  
write short lines wherever possible. So you could put params[:subject]  
into a  
variable, and maybe also use it somewhere else, or you could write this:

subjects\_owned\_by\_mikey = [ “owners.name = 123 AND  
subject = ?”, params[:subject] ]  
Email.find(:all, :conditions =\> subjects\_owned\_by\_mikey, :include =\>  
:owners)

That way you don’t have a hardcoded 123 (if that’s Mikey;).

Or you could go the other way, and use one of ActiveRecord’s automatic  
methods:

Email.find\_all\_by\_subject(params[:subject], :conditions =\> [‘owner\_id =  
123’])

You can also do the :include trick there.

> and how about this one:
> 
> 1. Email.find(:all,  
> :conditions =\>{“owner\_id = 123 AND subject = :subject”,  
> [:subject=\>params[:subject]]})

Of course. However, one reason for the :inserter facility is you might  
already  
have a hash available, for something else to use, and the :conditions  
can borrow  
it. Looking around, I see one such hash right there!:

Email.find\_all\_by\_owner\_id(123, :conditions =\> [“subject =\> :subject”,  
params])

Any other elements in params, your :conditions will ignore them.

Ruby, and Rails, permit an incredible diversity of expression, so you  
should  
find the one that reads well for your problem, and that has the fewest  
moving  
parts. find\_all\_by\_owner\_id has less parts than the primitive  
alternative.

Also, you should put useful routines like these into your own methods on  
the  
Email model, and you should write unit tests for every one of their  
behaviors.  
That way you can change the lines around, and find the most expressive  
statements, after getting their behavior right. Pass all the tests after  
every  
few edits, and revert your code if the tests fail.

–  
Phlip

---

<div class="post-metadata">

**Author:** ![Vincent.Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/90db22/32.png) [@Vincent.Z](https://www.ruby-forum.com/u/Vincent.Z)\
**Post date:** [March 18, 2008, 5:33pm UTC](https://www.ruby-forum.com/t/about-the-sql-injection/132070/3 "2008-03-18T17:33:00Z")

</div>

sorry,maybe im not very clear to my problem.

i wanna know if these style query can prevent the sql inject attack?

thanks again.