# Do I need to do mysql\_escape\_string and how?

**URL:** <https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334>\
**Category:** Rails\
**Created:** [January 7, 2007, 11:20pm UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334 "2007-01-07T23:20:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [January 7, 2007, 11:20pm UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334/1 "2007-01-07T23:20:31Z")

</div>

In my rails apps do I need to do mysql\_escape and if so what functions  
are around to be able to do this?

---

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [January 7, 2007, 11:57pm UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334/2 "2007-01-07T23:57:40Z")

</div>

is possible a sql injection when a model object is saved/created?  
for example a user which has a nick, is it possible to escape mysql  
using nick and '?

---

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [January 7, 2007, 11:50pm UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334/3 "2007-01-07T23:50:24Z")

</div>

paul wrote:

> In my rails apps do I need to do mysql\_escape and if so what functions  
> are around to be able to do this?

Let Rails take care of all such mundane things for you. Either assign  
your  
string, as string data, to a member of an ActiveRecord-derived object,  
or  
use your string in a find() using a parameter substitution system, like  
:conditions =\> [‘foo = ?’, my\_foo].

I suspect Rails will either correctly escape things, or will use the  
underlying Database’s parameterized query system.

All you need to do is remember never to put a tainted string directly  
into a  
fragment of an SQL statement. Never say, for example, :conditions =\>  
“foo =  
‘#{my\_foo}’”, because now you are vulnerable to SQL-insertion attacks.  
Rails  
cannot help a string with #{} in it, because that expands at Ruby time  
before Rails sees the string.

–  
Phlip  
[Redirecting...](http://www.greencheese.us/ZeekLand) ← NOT a blog!!!

---

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [January 8, 2007, 4:05pm UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334/4 "2007-01-08T16:05:41Z")

</div>

yeah that is the problem, I am generating the conditions statment in a  
string, which could be a security problem, I was wondering if there is a  
way to manually escape these fields whilst creating the conditions  
string?

---

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [January 8, 2007, 1:12am UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334/5 "2007-01-08T01:12:25Z")

</div>

John wrote:

> is possible a sql injection when a model object is saved/created?  
> for example a user which has a nick, is it possible to escape mysql  
> using nick and '?

I am not sure about the data written to the database on save, but I  
would be very surprised if it does not sanitize it.

Data read back will always be safe as long as you don’t insert strings  
directly (as Phlip demonstrates). See  
[Peak Obsession](http://manuals.rubyonrails.com/read/chapter/43).

---

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [January 8, 2007, 4:46pm UTC](https://www.ruby-forum.com/t/do-i-need-to-do-mysql-escape-string-and-how/81334/6 "2007-01-08T16:46:05Z")

</div>

paul wrote:

> yeah that is the problem, I am generating the conditions statment in a  
> string, which could be a security problem, I was wondering if there is a  
> way to manually escape these fields whilst creating the conditions  
> string?

:conditions =\> [" foo = ?", bar]

Always use at least the ? notation, This matches the raw database  
technique of parameterized queries. It escapes.

–  
Phlip  
[http://c2.com/cgi/wiki?ZeekLand](http://c2.com/cgi/wiki?ZeekLand) ← NOT a blog!!