# Easiest defense against SQL injection in object creation?

**URL:** <https://www.ruby-forum.com/t/easiest-defense-against-sql-injection-in-object-creation/124677>\
**Category:** Rails\
**Created:** [January 1, 2008, 1:27am UTC](https://www.ruby-forum.com/t/easiest-defense-against-sql-injection-in-object-creation/124677 "2008-01-01T01:27:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mlopke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9de053/32.png) [@mlopke](https://www.ruby-forum.com/u/mlopke)\
**Post date:** [January 1, 2008, 1:27am UTC](https://www.ruby-forum.com/t/easiest-defense-against-sql-injection-in-object-creation/124677/1 "2008-01-01T01:27:47Z")

</div>

I’ve been scouring the web for suggested Rails defenses against SQL  
injection, but I haven’t found much on the object creation part.  
Certainly using attr\_protected, etc., is a good way to prevent unwanted  
fields from being modified on the new object (if you’re passing a hash  
as creation parameters), but what about escaping the POSTed info before  
saving? Couldn’t you POST some SQL injector evilness into an ‘allowed’  
field and terminate the INSERT and maybe run some DELETES, etc.? Are  
people who pass the whole params hash setting themselves up for SQL  
armageddon?

Let me know if I’ve got it all wrong. And if there are built-in (or  
otherwise easy) ways to deal with _all_ such potential threats, that  
would be good to know, too. 🙂

Thanks,  
Mike

---

<div class="post-metadata">

**Author:** ![mlopke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9de053/32.png) [@mlopke](https://www.ruby-forum.com/u/mlopke)\
**Post date:** [January 1, 2008, 1:44am UTC](https://www.ruby-forum.com/t/easiest-defense-against-sql-injection-in-object-creation/124677/2 "2008-01-01T01:44:47Z")

</div>

Check this link  
[http://manuals.rubyonrails.com/read/chapter/43](http://manuals.rubyonrails.com/read/chapter/43)

Active Record takes care of most things for you.

Hope this helps,  
Cam

On Jan 1, 11:27 am, Mike L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![mlopke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/9de053/32.png) [@mlopke](https://www.ruby-forum.com/u/mlopke)\
**Post date:** [January 1, 2008, 1:59am UTC](https://www.ruby-forum.com/t/easiest-defense-against-sql-injection-in-object-creation/124677/3 "2008-01-01T01:59:47Z")

</div>

cammo wrote:

> Check this link  
> [Peak Obsession](http://manuals.rubyonrails.com/read/chapter/43)
> 
> Active Record takes care of most things for you.
> 
> Hope this helps,  
> Cam
> 
> On Jan 1, 11:27�am, Mike L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

Ah. I missed the ‘attributes are okay’ part last time I read through.  
🙂