# Finder\_sql and sql injection?

**URL:** <https://www.ruby-forum.com/t/finder-sql-and-sql-injection/91262>\
**Category:** Rails\
**Created:** [April 6, 2007, 3:27am UTC](https://www.ruby-forum.com/t/finder-sql-and-sql-injection/91262 "2007-04-06T03:27:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![suer\_rick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/bc8723/32.png) [@suer\_rick](https://www.ruby-forum.com/u/suer_rick)\
**Post date:** [April 6, 2007, 3:27am UTC](https://www.ruby-forum.com/t/finder-sql-and-sql-injection/91262/1 "2007-04-06T03:27:12Z")

</div>

The example from the api for has\_many looks like:

has\_many :subscribers, :class\_name =\> “Person”, :finder\_sql =\>  
'SELECT DISTINCT people.\* ’ +  
'FROM people p, post\_subscriptions ps ’ +  
'WHERE ps.post\_id = #{id} AND ps.person\_id = p.id ’ +  
‘ORDER BY p.first\_name’

Notice the interpolation: #{id}

Is this escaped, or is it vulnerable to sql injection? Is there a  
syntax that allows something like  
WHERE ps.post\_id = ?  
If so, what is it? My attempts so far don’t work.

---

<div class="post-metadata">

**Author:** ![suer\_rick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/bc8723/32.png) [@suer\_rick](https://www.ruby-forum.com/u/suer_rick)\
**Post date:** [April 6, 2007, 3:56am UTC](https://www.ruby-forum.com/t/finder-sql-and-sql-injection/91262/2 "2007-04-06T03:56:14Z")

</div>

> Is this escaped, or is it vulnerable to sql injection? Is there a  
> syntax that allows something like  
> WHERE ps.post\_id = ?  
> If so, what is it? My attempts so far don’t work.

Don’t know, but at a minimum you could change it to #{id.to\_i} to force  
it  
to return an integer value…

---

<div class="post-metadata">

**Author:** ![suer\_rick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/bc8723/32.png) [@suer\_rick](https://www.ruby-forum.com/u/suer_rick)\
**Post date:** [April 6, 2007, 4:11am UTC](https://www.ruby-forum.com/t/finder-sql-and-sql-injection/91262/3 "2007-04-06T04:11:30Z")

</div>

Rick S. wrote:

> Notice the interpolation: #{id}
> 
> Is this escaped, or is it vulnerable to sql injection?

It’s vulnerable to sql injection if the value of ‘id’ could be provided  
(i.e. corrupted) by the user.

> Is there a syntax that allows something like  
> WHERE ps.post\_id = ?

Agile Web D. with Rails includes the following example (p306):

Order.find\_by\_sql([“select \* from orders where amount \> ?”,  
params[:amount]])

Nat