# ActiveRecord::StatementInvalid Error

**URL:** <https://www.ruby-forum.com/t/activerecord-statementinvalid-error/148028>\
**Category:** Rails\
**Created:** [September 8, 2008, 1:36pm UTC](https://www.ruby-forum.com/t/activerecord-statementinvalid-error/148028 "2008-09-08T13:36:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohdanas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c6cbf5/32.png) [@mohdanas](https://www.ruby-forum.com/u/mohdanas)\
**Post date:** [September 8, 2008, 1:36pm UTC](https://www.ruby-forum.com/t/activerecord-statementinvalid-error/148028/1 "2008-09-08T13:36:35Z")

</div>

Hi There,

I’m gettings the following errors while accessing my application.  
Can someone please tell what is the possible cause and can it  
be resolved.  
"  
ActiveRecord::StatementInvalid in Site#showalladdress

Showing site/showalladdress.rhtml where line #3 raised:  
Mysql::Error: #42000You have an error in your SQL syntax; check the  
manual that corresponds to your MySQL server version for the right  
syntax to use near ‘and enabled=‘1’’ at line 1: select \* from  
addresses where typeid=2 and customerid= and enabled=‘1’

Extracted source (around line #3):  
1: Select Customer Address  
  
2:  
3: \<%=collection\_select “address”, :id, Address.find\_by\_sql(“select \*  
from addresses where typeid=#{params[:id]} and  
customerid=#{session[:customerid]} and enabled=‘1’”), :id, :address,  
{},  
{:onchange=\>“showcompletedetails()”,  
:onclick=\>remote\_function(:update=\>"",  
:url=\>{:action=\>“setaddress”},:with  
=\> “‘id=’ + $  
(‘address\_id’).value”),:size=\>“5”,:class=\>“dropdown”,:style=\>“width:  
100%;border:1px solid #0099cc;” }%\>  
"

Thanks

Mohd Anas

---

<div class="post-metadata">

**Author:** ![mohdanas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c6cbf5/32.png) [@mohdanas](https://www.ruby-forum.com/u/mohdanas)\
**Post date:** [September 8, 2008, 1:43pm UTC](https://www.ruby-forum.com/t/activerecord-statementinvalid-error/148028/2 "2008-09-08T13:43:03Z")

</div>

On 8 Sep 2008, at 11:56, mohdanas wrote:

> Mysql::Error: #42000You have an error in your SQL syntax; check the  
> manual that corresponds to your MySQL server version for the right  
> syntax to use near ‘and enabled=‘1’’ at line 1: select \* from  
> addresses where typeid=2 and customerid= and enabled=‘1’

Because you’ve generated invalid sql: “customerid= and”

which you’ve done because you’re using find\_by\_sql without checking  
all the things you’re interpolating (and exposing yourself to sql  
injection in the process)  
find\_by\_sql is completely unnecessary in this case

Fred