# ActiveRecord::Base#find is SQL injection free?

**URL:** <https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784>\
**Category:** Rails\
**Created:** [May 6, 2008, 12:18pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784 "2008-05-06T12:18:44Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 6, 2008, 12:18pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/1 "2008-05-06T12:18:44Z")

</div>

Hello All!  
Is the ActiveRecord::Base.find() :conditions option is safe to SQL  
Injections? Any comments on that?

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 6, 2008, 12:28pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/2 "2008-05-06T12:28:49Z")

</div>

it depends on correct usage

from [ActiveRecord::Base](http://api.rubyonrails.org/classes/ActiveRecord/Base.html)

Conditions can either be specified as a string, array, or hash  
representing the WHERE-part of an SQL statement. The array form is to be  
used when the condition input is tainted and requires sanitization. The  
string form can be used for statements that don‘t involve tainted data.  
The hash form works much like the array form, except only equality and  
range is possible. Examples:

class User \< ActiveRecord::Base  
def self.authenticate\_unsafely(user\_name, password)  
find(:first, :conditions =\> “user\_name = ‘#{user\_name}’ AND  
password = ‘#{password}’”)  
end

```
def self.authenticate_safely(user_name, password)
  find(:first, :conditions => [ "user_name = ? AND password = ?", 

```

user\_name, password ])  
end

```
def self.authenticate_safely_simply(user_name, password)
  find(:first, :conditions => { :user_name => user_name, :password 

```

=\> password })  
end  
end

The authenticate\_unsafely method inserts the parameters directly into  
the query and is thus susceptible to SQL-injection attacks if the  
user\_name and password parameters come directly from an HTTP request.  
The authenticate\_safely and authenticate\_safely\_simply both will  
sanitize the user\_name and password before inserting them in the query,  
which will ensure that an attacker can‘t escape the query and fake the  
login (or worse).

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 6, 2008, 12:41pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/3 "2008-05-06T12:41:13Z")

</div>

On 6 May 2008, at 11:18, MohsinHijazee wrote:

> Hello All!  
> Is the ActiveRecord::Base.find() :conditions option is safe to SQL  
> Injections? Any comments on that?

Yes it is, as long as you use it in the intended way (ie :conditions  
=\> {:name =\> 'foo}, :conditions =\> [‘name = ?’, ‘foo’] etc…).  
You can break it if you try, eg :conditions =\> “#{some\_string}”

Fred

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 6, 2008, 2:31pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/4 "2008-05-06T14:31:35Z")

</div>

On 6 May 2008, at 12:00, MohsinHijazee wrote:

> is this ok??? If not, then any workaround?  
> That is not a good idea. It’s not sql injection free because what  
> you’re doing is allowing people to inject sql. In fact you’re not just  
> allowing it, you’re depending on it.  
> It also sounds like a pretty horrific piece of UI.  
> Fred

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 6, 2008, 3:16pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/5 "2008-05-06T15:16:34Z")

</div>

MohsinHijazee wrote:

> Thank you very much for this useful post!  
> Well, my situation is worst then that.  
> My WHOLE condition comes from the user like:  
> params[:conditions] = “user\_name=‘Raphael’ AND age \> 20”

Ack!!!

The only safe way to do that (that occurs to me at the moment) is to  
strip apart the conditions you receive into a list of field / value  
pairs, validate each field against what should be allowed for the model  
(discarding those that don’t reference valid fields, or reference fields  
the user shouldn’t know about), then construct a conditions statement  
that still allows rails to do its thing with either of the “safely”  
methods shown above.

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 6, 2008, 1:01pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/6 "2008-05-06T13:01:26Z")

</div>

On May 6, 3:28 pm, Thorsten M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> sanitize the user\_name and password before inserting them in the query,  
> which will ensure that an attacker can‘t escape the query and fake the  
> login (or worse).

Thank you very much for this useful post!  
Well, my situation is worst then that.  
My WHOLE condition comes from the user like:  
params[:conditions] = “user\_name=‘Raphael’ AND age \> 20”  
So the essence is that any condition can be specified.

And in my controller, I do this:  
users = User.find(:all, :conditions =\> params[:conditions])  
return users

is this ok??? If not, then any workaround?

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 8, 2008, 2:21pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/7 "2008-05-08T14:21:45Z")

</div>

On May 6, 6:16 pm, Ar Chron [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> pairs, validate each field against what should be allowed for the model  
> (discarding those that don’t reference valid fields, or reference fields  
> the user shouldn’t know about), then construct a conditions statement  
> that still allows rails to do its thing with either of the “safely”  
> methods shown above.  
> yes you are right. I also thought about it that we need to verify the  
> incoming fields on bases of key value pairs and then remove unsafe  
> parts perhaps. This is not part of the UI, its basically a requirement  
> for the REST API where it should be possible for the consumer of the  
> API to specify the records under certain conditions.

---

<div class="post-metadata">

**Author:** ![MohsinHijazee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e68b1a/32.png) [@MohsinHijazee](https://www.ruby-forum.com/u/MohsinHijazee)\
**Post date:** [May 25, 2008, 11:13pm UTC](https://www.ruby-forum.com/t/activerecord-base-find-is-sql-injection-free/136784/8 "2008-05-25T23:13:04Z")

</div>

I have tested: find(params[:id]) by submitting:  
a’ or ‘t’='t  
or  
1; DROP TABLE super\_cool\_table;

and it is perfectly safe, the generated SQL query did not pick up the  
injection.