# Could someone tell me if the query is secure

**URL:** <https://www.ruby-forum.com/t/could-someone-tell-me-if-the-query-is-secure/178105>\
**Category:** Rails\
**Created:** [October 29, 2009, 4:34am UTC](https://www.ruby-forum.com/t/could-someone-tell-me-if-the-query-is-secure/178105 "2009-10-29T04:34:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mitch\_newbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea5d25/32.png) [@mitch\_newbie](https://www.ruby-forum.com/u/mitch_newbie)\
**Post date:** [October 29, 2009, 4:34am UTC](https://www.ruby-forum.com/t/could-someone-tell-me-if-the-query-is-secure/178105/1 "2009-10-29T04:34:35Z")

</div>

I understand that its easy for someone to do all kinds of nasty things  
to a database. I am trying to work on security.

Could someone tell me if the following query is structured correctly for  
security

#find matching manufacturers  
def self.find\_all(manufacturer="")  
find(:all, :order =\> “name”, :conditions =\> [“name like ?”,  
“%#{manufacturer}%”])  
end

Thank you in advance

Mitchell

---

<div class="post-metadata">

**Author:** ![mitch\_newbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea5d25/32.png) [@mitch\_newbie](https://www.ruby-forum.com/u/mitch_newbie)\
**Post date:** [October 29, 2009, 4:47am UTC](https://www.ruby-forum.com/t/could-someone-tell-me-if-the-query-is-secure/178105/2 "2009-10-29T04:47:42Z")

</div>

Mitchell G. wrote:

> I understand that its easy for someone to do all kinds of nasty things  
> to a database. I am trying to work on security.
> 
> Could someone tell me if the following query is structured correctly for  
> security
> 
> #find matching manufacturers  
> def self.find\_all(manufacturer=“”)  
> find(:all, :order =\> “name”, :conditions =\> [“name like ?”,  
> “%#{manufacturer}%”])  
> end

I believe so. The only user input is bound to a placeholder symbol  
(‘?’), which will mean that a parameterized query will be used.  
Therefore, I don’t think SQL injection is possible, and I don’t see any  
other problems.

By contrast, “name like %#{manufacturer}%” would be insecure.

> Thank you in advance
> 
> Mitchell

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![mitch\_newbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea5d25/32.png) [@mitch\_newbie](https://www.ruby-forum.com/u/mitch_newbie)\
**Post date:** [October 29, 2009, 9:00am UTC](https://www.ruby-forum.com/t/could-someone-tell-me-if-the-query-is-secure/178105/3 "2009-10-29T09:00:35Z")

</div>

Hi

> By contrast, “name like %#{manufacturer}%” would be insecure.

And I think this too is secure unless manufacture is the direct user  
input from params etc

Sijo

---

<div class="post-metadata">

**Author:** ![mitch\_newbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea5d25/32.png) [@mitch\_newbie](https://www.ruby-forum.com/u/mitch_newbie)\
**Post date:** [October 29, 2009, 9:43am UTC](https://www.ruby-forum.com/t/could-someone-tell-me-if-the-query-is-secure/178105/4 "2009-10-29T09:43:00Z")

</div>

Sijo k g wrote:

> Hi
> 
> > By contrast, “name like %#{manufacturer}%” would be insecure.
> 
> And I think this too is secure unless manufacture is the direct user  
> input from params etc
> 
> Sijo

Hey thanks for the feedback. manufacturer is the direct user input.

cheers

Mitch