# Escaping strings

**URL:** <https://www.ruby-forum.com/t/escaping-strings/184716>\
**Category:** Ruby\
**Created:** [March 7, 2010, 8:23am UTC](https://www.ruby-forum.com/t/escaping-strings/184716 "2010-03-07T08:23:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![advenk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ebca7d/32.png) [@advenk](https://www.ruby-forum.com/u/advenk)\
**Post date:** [March 7, 2010, 8:23am UTC](https://www.ruby-forum.com/t/escaping-strings/184716/1 "2010-03-07T08:23:09Z")

</div>

Hi,

This seems rather easy, but its got me stuck.

i am using ruby DBI to insert records into a mysql database.

dbh.do(“INSERT INTO sentences (id,text)  
VALUES  
(#{id},#{sentence})”)

the sentence is a pretty long and complex string having many special  
characters. I cant seem to escape it out, i tried CGI and the %&&  
delimiters, but i cant get it to work.

I appreciate your help!

Thanks!

---

<div class="post-metadata">

**Author:** ![advenk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ebca7d/32.png) [@advenk](https://www.ruby-forum.com/u/advenk)\
**Post date:** [March 7, 2010, 9:13am UTC](https://www.ruby-forum.com/t/escaping-strings/184716/2 "2010-03-07T09:13:41Z")

</div>

Nvm, got it.

require ‘mysql’

sentence = Mysql.escape\_string(sentence.to\_s)  
dbh.do(“INSERT INTO sentences (id,text)  
VALUES  
(#{id}, '” + sentence + “’)”)

🙂

---

<div class="post-metadata">

**Author:** ![advenk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ebca7d/32.png) [@advenk](https://www.ruby-forum.com/u/advenk)\
**Post date:** [March 7, 2010, 6:21pm UTC](https://www.ruby-forum.com/t/escaping-strings/184716/3 "2010-03-07T18:21:45Z")

</div>

On 03/07/2010 09:14 AM, Krishna Rokhale wrote:

> 🙂

I’d rather use prepared statements with bind variables. This is much  
safer and also you can offload a bit of work from the database.

Kind regards

robert

---

<div class="post-metadata">

**Author:** ![advenk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/ebca7d/32.png) [@advenk](https://www.ruby-forum.com/u/advenk)\
**Post date:** [March 7, 2010, 11:09pm UTC](https://www.ruby-forum.com/t/escaping-strings/184716/4 "2010-03-07T23:09:52Z")

</div>

Robert K. wrote:

> On 03/07/2010 09:14 AM, Krishna Rokhale wrote:
> 
> > 🙂
> 
> I’d rather use prepared statements with bind variables. This is much  
> safer and also you can offload a bit of work from the database.
> 
> Kind regards
> 
> robert

Thanks!