# ActiveRecord + Postgres + \\000 = BOOM

**URL:** <https://www.ruby-forum.com/t/activerecord-postgres-000-boom/84275>\
**Category:** Rails\
**Created:** [February 2, 2007, 8:56pm UTC](https://www.ruby-forum.com/t/activerecord-postgres-000-boom/84275 "2007-02-02T20:56:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![robinluckey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/258eb7/32.png) [@robinluckey](https://www.ruby-forum.com/u/robinluckey)\
**Post date:** [February 2, 2007, 8:56pm UTC](https://www.ruby-forum.com/t/activerecord-postgres-000-boom/84275/1 "2007-02-02T20:56:18Z")

</div>

We’ve been seeing some queries against our Rails website which include  
the “\000” character in some string params. I don’t know if these are  
malicious or not, but Postgres does not like them at all, and  
ActiveRecord does not help us by escaping this character.

It’s easy to repro:

$ script/console

> > Account.find\_by\_name("\000")  
> > ActiveRecord::StatementInvalid: PGError: ERROR: unterminated quoted  
> > string at or near “’” at character 50  
> > : SELECT \* FROM accounts WHERE (accounts.“login” = ‘’ ) LIMIT 1

It seems that somewhere in the chain, either ActiveRecord or the  
Postgres connection code should either strip or escape the \000  
character.

This is pretty difficult problem to google against, but it seems  
unlikely we’re the only ones with this issue. Anyone?

We’re on Edge Rails revision 4798 and PostgreSQL 8.1.6.

Thanks,  
Robin

---

<div class="post-metadata">

**Author:** ![robinluckey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/258eb7/32.png) [@robinluckey](https://www.ruby-forum.com/u/robinluckey)\
**Post date:** [February 3, 2007, 12:01am UTC](https://www.ruby-forum.com/t/activerecord-postgres-000-boom/84275/2 "2007-02-03T00:01:37Z")

</div>

removed\_email\_address@domain.invalid wrote:

> > >
> 
> We’re on Edge Rails revision 4798 and PostgreSQL 8.1.6.
> 
> Thanks,  
> Robin
> 
> >

not much help but it’s known as a “poison null byte” iirc - used for sql  
injection

---

<div class="post-metadata">

**Author:** ![robinluckey](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/258eb7/32.png) [@robinluckey](https://www.ruby-forum.com/u/robinluckey)\
**Post date:** [February 3, 2007, 5:22am UTC](https://www.ruby-forum.com/t/activerecord-postgres-000-boom/84275/3 "2007-02-03T05:22:59Z")

</div>

unfortunately postgresql uses c-strings, and therefore treats binary  
nulls in a “c way”. They could avoid it but haven’t done it so far as  
far as I know…