# Attributes not being santised **URL:** \ **Category:** Rails\ **Created:** [April 14, 2008, 2:37pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729 "2008-04-14T14:37:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 14, 2008, 2:37pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/1 "2008-04-14T14:37:31Z")
I’m using a postgres database and have run into problems where attributes on a model are not sanitised correctly before being saved. The following code: comment = Comment.new( :item =\> item ) comment.comment = “dog’s breakfast” comment.save Produces the following incorrect SQL in my logs: SELECT id FROM comments WHERE (item\_id = 38 and comment = ‘Dog’s breakfast’ and subscriber\_id = ‘90’) As you can see the ’ in “Dog’s breakfast” is causing issues. How do I ensure this is sanitised correctly? ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 14, 2008, 3:20pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/2 "2008-04-14T15:20:02Z")
On 14 Apr 2008, at 13:36, Farrel wrote: > SELECT id FROM comments WHERE (item\_id = 38 and comment = ‘Dog’s > breakfast’ and subscriber\_id = ‘90’) Are you sure this is the relevant snippet - why would a save be doing a select? Fred ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 14, 2008, 3:25pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/3 "2008-04-14T15:25:20Z")
On Apr 14, 3:19 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Are you sure this is the relevant snippet - why would a save be doing > a select? > > Fred I’m not sure, it seems to be done by Rails. Farrel ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 14, 2008, 3:43pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/4 "2008-04-14T15:43:02Z")
On 14 Apr 2008, at 14:24, Farrel wrote: > On Apr 14, 3:19 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > wrote: > > > Are you sure this is the relevant snippet - why would a save be doing > > a select? > > > > Fred > > I’m not sure, it seems to be done by Rails. The obivous way to do it is to delete your development.log file, open up the console and whack in what you had before (and only that) and see what’s in the logs after. Fred ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 14, 2008, 3:45pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/5 "2008-04-14T15:45:59Z")
On Apr 14, 3:30 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > The obivous way to do it is to delete your development.log file, open > up the console and whack in what you had before (and only that) and > see what’s in the logs after. > > Fred I did that and it still does a select before doing an insert. Again not sure why, but that is secondary to my question about the ’ not being sanitised in the attribute. Farrel ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 14, 2008, 9:49pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/6 "2008-04-14T21:49:59Z")
On Apr 14, 2008, at 9:40 AM, Farrel wrote: > not sure why, but that is secondary to my question about the ’ not > being sanitised in the attribute. > > Farrel Do you have any validations on the model? In particular, validates\_uniqueness\_of will cause “select before insert” -Rob Rob B. [http://agileconsultingllc.com](http://agileconsultingllc.com) removed\_email\_address@domain.invalid ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 15, 2008, 9:10am UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/7 "2008-04-15T09:10:53Z")
Farrel wrote: > I’m using a postgres database and have run into problems where > attributes on a model are not sanitised correctly before being saved. > The following code: > > comment = Comment.new( :item =\> item ) > comment.comment = “dog’s breakfast” > comment.save > > Produces the following incorrect SQL in my logs: > SELECT id FROM comments WHERE (item\_id = 38 and comment = ‘Dog’s > breakfast’ and subscriber\_id = ‘90’) > > As you can see the ’ in “Dog’s breakfast” is causing issues. How do I > ensure this is sanitised correctly? you could sanitize it yourself (?) ---
**Author:** ![Farrel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/bcef8e/32.png) [@Farrel](https://www.ruby-forum.com/u/Farrel)\ **Post date:** [April 15, 2008, 12:16pm UTC](https://www.ruby-forum.com/t/attributes-not-being-santised/134729/8 "2008-04-15T12:16:19Z")
On Apr 15, 9:10 am, Roger P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > you could sanitize it yourself (?) That’s what I eventually did. Farrel