# Find

**URL:** <https://www.ruby-forum.com/t/find/120415>\
**Category:** Rails\
**Created:** [November 16, 2007, 6:24pm UTC](https://www.ruby-forum.com/t/find/120415 "2007-11-16T18:24:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [November 16, 2007, 6:24pm UTC](https://www.ruby-forum.com/t/find/120415/1 "2007-11-16T18:24:48Z")

</div>

Hi all,

I would like to modify this find\_by\_sql to work using just the normal  
find.

User.find\_by\_sql(“SELECT \* FROM users WHERE role = " +  
params[:user][:role] + " and first LIKE A%”)

this works, I just don’t like doing it this way. Thanks,

-S

---

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [November 16, 2007, 6:30pm UTC](https://www.ruby-forum.com/t/find/120415/2 "2007-11-16T18:30:06Z")

</div>

On Nov 16, 2007 12:24 PM, Shandy N.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> -S

Try:

User.find(:all, :conditions =\> [“role = ? and first LIKE A%”,  
params[:user][:role]] )

Just a warning, what you’ve got now has an SQL injection attack. Think  
about  
what happens if someone posts the following:

params[user[role]]=“name; DROP TABLE users; --”

What I’ve posted properly sanitizes the input so this can’t happen.

Jason

---

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [November 16, 2007, 8:04pm UTC](https://www.ruby-forum.com/t/find/120415/3 "2007-11-16T20:04:33Z")

</div>

On Nov 16, 2007 12:29 PM, Jason R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> User.find(:all, :conditions =\> [“role = ? and first LIKE A%”,  
> params[:user][:role]] )
> 
> Just a warning, what you’ve got now has an SQL injection attack. Think about  
> what happens if someone posts the following:
> 
> params[user[role]]=“name; DROP TABLE users; --”
> 
> What I’ve posted properly sanitizes the input so this can’t happen.

## [xkcd: Exploits of a Mom](http://xkcd.com/327/)

Rick DeNatale

My blog on Ruby  
[http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/)

---

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [November 16, 2007, 8:41pm UTC](https://www.ruby-forum.com/t/find/120415/4 "2007-11-16T20:41:30Z")

</div>

On Nov 16, 2007, at 2:34 PM, Shandy N. wrote:

> > 
> 
> -S  
> Your problem isn’t too many parentheses, it is too few quotes. Try  
> either of these:

@users = User.find(:all, :conditions =\> [“role = ? and first LIKE ‘A  
%’”, params[:role]] )

or

@users = User.find(:all, :conditions =\> [“role = ? and first LIKE ?”,  
params[:role], ‘A%’] )

-Rob

Rob B. [http://agileconsultingllc.com](http://agileconsultingllc.com)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [November 16, 2007, 8:34pm UTC](https://www.ruby-forum.com/t/find/120415/5 "2007-11-16T20:34:06Z")

</div>

Jason R. wrote:

> Try:
> 
> User.find(:all, :conditions =\> [“role = ? and first LIKE A%”,  
> params[:user][:role]] )
> 
> Just a warning, what you’ve got now has an SQL injection attack. Think  
> about  
> what happens if someone posts the following:
> 
> params[user[role]]=“name; DROP TABLE users; --”
> 
> What I’ve posted properly sanitizes the input so this can’t happen.
> 
> Jason

This find method gives the following error:

Ryyerror: SELECT \* FROM users WHERE (role = ‘Traveler’ and first LIKE  
A%)

Why is it putting the parens?

This is my exact code:

@users = User.find(:all, :conditions =\> [“role = ? and first LIKE A%”,  
params[:role]] )

Thanks again,

-S

---

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [November 16, 2007, 8:41pm UTC](https://www.ruby-forum.com/t/find/120415/6 "2007-11-16T20:41:43Z")

</div>

Shandy N. wrote:

> @users = User.find(:all, :conditions =\> [“role = ? and first LIKE A%”,  
> params[:role]] )

I got it, I was missing quotes:

@users = User.find(:all, :conditions =\> [“role = ? and first LIKE  
‘A%’”,  
params[:role]] )