# How to pass variable value to a sql query

**URL:** <https://www.ruby-forum.com/t/how-to-pass-variable-value-to-a-sql-query/124743>\
**Category:** Ruby\
**Created:** [January 2, 2008, 4:45am UTC](https://www.ruby-forum.com/t/how-to-pass-variable-value-to-a-sql-query/124743 "2008-01-02T04:45:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pradeepta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ee59a6/32.png) [@pradeepta](https://www.ruby-forum.com/u/pradeepta)\
**Post date:** [January 2, 2008, 4:45am UTC](https://www.ruby-forum.com/t/how-to-pass-variable-value-to-a-sql-query/124743/1 "2008-01-02T04:45:22Z")

</div>

Hi,  
How can i pass a variable to a sql query like

```
rs = dbh.prepare("select *from status_check where id=204")
rs.execute

```

Instead of giving the value of id I want to make it dynamic ,where I can  
pass the dynamic value of id fetched from database much like in PL/SQL .  
How to do this .Anybody help !!

---

<div class="post-metadata">

**Author:** ![pradeepta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ee59a6/32.png) [@pradeepta](https://www.ruby-forum.com/u/pradeepta)\
**Post date:** [January 2, 2008, 8:01am UTC](https://www.ruby-forum.com/t/how-to-pass-variable-value-to-a-sql-query/124743/2 "2008-01-02T08:01:36Z")

</div>

Pradeepta S. wrote:

> Hi,  
> How can i pass a variable to a sql query like
> 
> ```
> rs = dbh.prepare("select *from status_check where id=204")
> rs.execute
> 
> ```
> 
> Instead of giving the value of id I want to make it dynamic ,where I can  
> pass the dynamic value of id fetched from database much like in PL/SQL .  
> How to do this .Anybody help !!

rs = dbh.prepare(“select \*from status\_check where id=#{value}”)  
rs.execute

---

<div class="post-metadata">

**Author:** ![pradeepta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ee59a6/32.png) [@pradeepta](https://www.ruby-forum.com/u/pradeepta)\
**Post date:** [January 2, 2008, 5:12am UTC](https://www.ruby-forum.com/t/how-to-pass-variable-value-to-a-sql-query/124743/3 "2008-01-02T05:12:22Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

On Jan 1, 2008, at 9:45 PM, Pradeepta S. wrote:

> ## How to do this .Anybody help !!
> 
> Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/).

look up “placeholders”. A google search yielded:  
[http://www.kitebird.com/articles/ruby-dbi.html#TOC\_8](http://www.kitebird.com/articles/ruby-dbi.html#TOC_8)

David M.  
Maia Mailguard [http://www.maiamailguard.com](http://www.maiamailguard.com)  
removed\_email\_address@domain.invalid

-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFHew7gUy30ODPkzl0RAsIKAJ4kBWKmfTmF0k083dj2yAIK+4ZsrgCeOHWV  
iqgUQG+oXnKiR0ZBH8NyEHQ=  
=eXia  
-----END PGP SIGNATURE-----

---

<div class="post-metadata">

**Author:** ![pradeepta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ee59a6/32.png) [@pradeepta](https://www.ruby-forum.com/u/pradeepta)\
**Post date:** [January 2, 2008, 8:11am UTC](https://www.ruby-forum.com/t/how-to-pass-variable-value-to-a-sql-query/124743/4 "2008-01-02T08:11:05Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

On Jan 2, 2008, at 1:01 AM, Karthi kn wrote:

> > SQL .  
> > How to do this .Anybody help !!
> 
> rs = dbh.prepare(“select \*from status\_check where id=#{value}”)  
> rs.execute

NO! This is a security risk.

This opens you up to sql injection attacks. You should always use  
placeholders so the library can properly escape your input. See my  
other message for a link on how to use placeholders.

David M.  
Maia Mailguard [http://www.maiamailguard.com](http://www.maiamailguard.com)  
removed\_email\_address@domain.invalid

-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFHezjOUy30ODPkzl0RAtFmAJ4qoogCOpMZk+gWRbwGUL08OtTzKwCgiQm6  
HWDyvWfx2dhMYYvHKbme4ZA=  
=2tT+  
-----END PGP SIGNATURE-----