# Double Quotes Problem in mysql **URL:** \ **Category:** Rails\ **Created:** [April 10, 2009, 12:56pm UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228 "2009-04-10T12:56:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [April 10, 2009, 12:56pm UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228/1 "2009-04-10T12:56:56Z")
Hi All, I am using following code to find the artist @actual\_artist=Artist.find\_by\_name(params[:record][:artist\_name]) —Line A my problem is that i receive da ta like params[:record][:artist\_name]=“Acg”" so my application crashes on Line A. How to avoid it … Thanx in Advance Salil ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [April 10, 2009, 1:20pm UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228/2 "2009-04-10T13:20:20Z")
On Apr 10, 11:56 am, Salil G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi All, > I am using following code to find the artist > @actual\_artist=Artist.find\_by\_name(params[:record][:artist\_name]) > —Line A > > my problem is that i receive da ta like > params[:record][:artist\_name]=“Acg"” > > so my application crashes on Line A. What error do you get ? Fred ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [April 11, 2009, 6:16pm UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228/3 "2009-04-11T18:16:56Z")
The problem here is that update\_all doesn’t actually sanitize the value passed to the ‘updates’ parameter. Your particular example will work if you change just surround the #{@album} in single quotes, but that’s obviously not going to address the broader problem. Rather, you’ll need to do something like the following: records = Find(:all, :conditions =\> {:artist\_name =\> @corrected\_artist.artist\_name, :album\_name =\> @corrected\_artist.album\_name, :upc =\> corrected\_artist.upc}) records.each {|r| r.update\_attributes({:artist =\> @artist, :album\_name =\> @album, :upc =\> params[:upc], :status =\> ‘corrected’}) The basic idea is to retrieve all the records to be updated first (or for better performance just the list of IDs to be updated), and _then_ use the ActiveRecord::Base methods that actually know how to sanitize input. On Apr 11, 4:48 am, Salil G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [April 11, 2009, 6:53pm UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228/4 "2009-04-11T18:53:48Z")
On Apr 11, 5:16 pm, pharrington [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > The problem here is that update\_all doesn’t actually sanitize the > value passed to the ‘updates’ parameter. It can do if you give it a chance, eg TempRoyaltyReport.update\_all ([“artist\_name=?”, @artist\_name]) or TempRoyaltyReport.update\_all ( :artist\_name =\> @artist\_name). Just like the conditions you pass to find. Fred ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [April 11, 2009, 7:13pm UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228/5 "2009-04-11T19:13:42Z")
Don’t know why i didn’t know this. Thanks! On Apr 11, 12:52 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [April 11, 2009, 10:48am UTC](https://www.ruby-forum.com/t/double-quotes-problem-in-mysql/165228/6 "2009-04-11T10:48:42Z")
> What error do you get ? > > Fred sorry fred i’m unable to reproduce same error. So i start with another one… params[:album]=“Bust a Move (12” Remixes) - EP" TempRoyaltyReport.update\_all(“artist\_name=#{@artist},album\_name =#{@album},upc = #{params[:upc]},status = ‘corrected’”, “artist\_name = “#{@corrected\_artist.artist\_name}” and album\_name = “#{@corrected\_artist.album\_name}” and upc = ‘#{@corrected\_artist.upc}’”) And I get following error Mysql::Error: #42000You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘Remixes) - EP",upc = 829357903914,status = ‘corrected’ WHERE (artist\_name = "VAR’ at line 1: UPDATE temp\_royalty\_reports SET artist\_name=“Young MC”,album\_name =“Bust a Move (12” Remixes) - EP",upc = 829357903914,status = ‘corrected’ WHERE (artist\_name = “VARIOUS ARTISTS” and album\_name = “RMXXOLOGY DELUXE” and isrc = ‘USDE10801060’)