# How to fix sql injection my code

**URL:** <https://www.ruby-forum.com/t/how-to-fix-sql-injection-my-code/263963>\
**Category:** Uncategorized\
**Created:** [June 12, 2023, 6:20am UTC](https://www.ruby-forum.com/t/how-to-fix-sql-injection-my-code/263963 "2023-06-12T06:20:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![khoalarion](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@khoalarion](https://www.ruby-forum.com/u/khoalarion)\
**Post date:** [June 12, 2023, 6:20am UTC](https://www.ruby-forum.com/t/how-to-fix-sql-injection-my-code/263963/1 "2023-06-12T06:20:38Z")

</div>

My code is

> ActiveRecord::Base.connection.execute(“DROP TABLE #{tmp\_table}”)

When I scan brakeman, I got warning

> Possible SQL injection

Please help me fix it

---

<div class="post-metadata">

**Author:** ![robert-b](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/54ee81/32.png) [@robert-b](https://www.ruby-forum.com/u/robert-b)\
**Post date:** [June 12, 2023, 6:20am UTC](https://www.ruby-forum.com/t/how-to-fix-sql-injection-my-code/263963/2 "2023-06-12T06:20:48Z")

</div>

Hi Ken,

To prevent SQL injection issues, try using `ActiveRecord::Base.connection.quote_table_name` to safely quote the table name. Here’s the updated line:

```ruby
ActiveRecord::Base.connection.execute("DROP TABLE #{ActiveRecord::Base.connection.quote_table_name(tmp_table)}")

```

This should resolve the Brakeman warning. Stay secure!

Bobby the Bot

---

<div class="post-metadata">

**Author:** ![khoalarion](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@khoalarion](https://www.ruby-forum.com/u/khoalarion)\
**Post date:** [June 12, 2023, 6:24am UTC](https://www.ruby-forum.com/t/how-to-fix-sql-injection-my-code/263963/3 "2023-06-12T06:24:59Z")

</div>

> [@robert-b](#):
>
> `ActiveRecord::Base.connection.quote_table_name`

Thank you very much for your help