# Find\_by\_sql and passing parameter value

**URL:** <https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799>\
**Category:** Rails\
**Created:** [May 6, 2008, 2:39pm UTC](https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799 "2008-05-06T14:39:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![KTU](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ecae2f/32.png) [@KTU](https://www.ruby-forum.com/u/KTU)\
**Post date:** [May 6, 2008, 2:39pm UTC](https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799/1 "2008-05-06T14:39:20Z")

</div>

Any idea why I cant pass parameter value for the find\_by\_sql query ?  
simple example below wont work:

loginid = “demo”

sql = ‘SELECT \* FROM users where ownerid = “loginid”’

@imitems = Imitem.find\_by\_sql(sql);

but if I change query to this it works:

sql = ‘SELECT \* FROM users where ownerid = “demo”’

---

<div class="post-metadata">

**Author:** ![KTU](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ecae2f/32.png) [@KTU](https://www.ruby-forum.com/u/KTU)\
**Post date:** [May 6, 2008, 2:58pm UTC](https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799/2 "2008-05-06T14:58:08Z")

</div>

On 6 May 2008, at 13:38, KTU wrote:

> Any idea why I cant pass parameter value for the find\_by\_sql query ?  
> simple example below wont work:
> 
> loginid = “demo”
> 
> sql = ‘SELECT \* FROM users where ownerid = “loginid”’

Read up on your ruby. How’s ruby to know that loginid refers to a  
variable rather than just the string loginid.  
#{} and connection.quote are your friend.  
But before you do that, why on earth are you using find\_by\_sql?  
ImItem.find :all, :conditions =\> {:ownerid =\> loginid}  
is easier to understand and you have less chance of shooting yourself  
in the foot.

Fred

---

<div class="post-metadata">

**Author:** ![KTU](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ecae2f/32.png) [@KTU](https://www.ruby-forum.com/u/KTU)\
**Post date:** [May 6, 2008, 3:29pm UTC](https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799/3 "2008-05-06T15:29:48Z")

</div>

Im using it since I have very complex query. I just put here simple  
example. And yes I tried “#{loginid}” but it wont pass the variable.

On May 6, 3:56 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![KTU](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ecae2f/32.png) [@KTU](https://www.ruby-forum.com/u/KTU)\
**Post date:** [May 6, 2008, 3:51pm UTC](https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799/4 "2008-05-06T15:51:21Z")

</div>

On 6 May 2008, at 14:28, KTU wrote:

> Im using it since I have very complex query. I just put here simple  
> example. And yes I tried “#{loginid}” but it wont pass the variable.

Because your string is using single quotes. Single quotes don’t  
interpolate.

Fred

---

<div class="post-metadata">

**Author:** ![KTU](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ecae2f/32.png) [@KTU](https://www.ruby-forum.com/u/KTU)\
**Post date:** [May 6, 2008, 5:40pm UTC](https://www.ruby-forum.com/t/find-by-sql-and-passing-parameter-value/136799/5 "2008-05-06T17:40:01Z")

</div>

You’re not using parameterized SQL. Try:

@imitems = Imitem.find\_by\_sql(‘select \* from users where ownerid = ?’,  
loginid)

HTH,

-Roy