# Escaping SQL when using connection.execute?

**URL:** <https://www.ruby-forum.com/t/escaping-sql-when-using-connection-execute/144749>\
**Category:** Rails\
**Created:** [August 1, 2008, 7:17pm UTC](https://www.ruby-forum.com/t/escaping-sql-when-using-connection-execute/144749 "2008-08-01T19:17:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![starmaerker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e9bcb4/32.png) [@starmaerker](https://www.ruby-forum.com/u/starmaerker)\
**Post date:** [August 1, 2008, 7:17pm UTC](https://www.ruby-forum.com/t/escaping-sql-when-using-connection-execute/144749/1 "2008-08-01T19:17:02Z")

</div>

Hi all,

Here’s the situation: I’m writing a Rails app that connect to a SQL  
Server DB via the ODBC adapter. As an outside, non-negotiable  
requirement, and writes to the DB must be performed using stored  
procedures. (I know, I know… it sucks).

When constructing the query string, how do I go about escaping the  
parameters I want to insert.

My first thought was Rail’s parameterization of query strings:  
Model.connection.execute [“EXECUTE dumb\_sp ‘?’,’?’,’?’”, a, b, c]  
No luck, execute doesn’t accept that, it will only accept a string.

Am I stuck with gsubbing all those strings or is there away to compile  
the array form to a query that I could use?

Thanks,

Andrew

---

<div class="post-metadata">

**Author:** ![starmaerker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e9bcb4/32.png) [@starmaerker](https://www.ruby-forum.com/u/starmaerker)\
**Post date:** [August 1, 2008, 9:30pm UTC](https://www.ruby-forum.com/t/escaping-sql-when-using-connection-execute/144749/2 "2008-08-01T21:30:39Z")

</div>

Check the Rails API for various sanitize\_sql\_\* methods.

---

<div class="post-metadata">

**Author:** ![starmaerker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e9bcb4/32.png) [@starmaerker](https://www.ruby-forum.com/u/starmaerker)\
**Post date:** [August 4, 2008, 6:05pm UTC](https://www.ruby-forum.com/t/escaping-sql-when-using-connection-execute/144749/3 "2008-08-04T18:05:34Z")

</div>

Steve,

That was my first thought. However they are protected methods of  
ActionController::Base. I was hoping to write the methods in the  
model, where they belong.

Andrew

---

<div class="post-metadata">

**Author:** ![starmaerker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e9bcb4/32.png) [@starmaerker](https://www.ruby-forum.com/u/starmaerker)\
**Post date:** [August 4, 2008, 6:19pm UTC](https://www.ruby-forum.com/t/escaping-sql-when-using-connection-execute/144749/4 "2008-08-04T18:19:39Z")

</div>

On 4 Aug 2008, at 17:04, Andrew S. wrote:

> Steve,
> 
> That was my first thought. However they are protected methods of  
> ActionController::Base. I was hoping to write the methods in the  
> model, where they belong.

I’m sure you meant ActiveRecord::Base 🙂 Shouldn’t be a problem  
calling them from a model. They’re class methods though, so if you  
were doing this from an instance method you’d have to do a slightly  
ugly self.class.send(:sanitize\_sql …).

Fred