# How to secure code against sql injection on Ruby-sinatra

**URL:** <https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576>\
**Category:** Uncategorized\
**Created:** [March 10, 2022, 12:38pm UTC](https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576 "2022-03-10T12:38:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Supelec](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d6d6ee/32.png) [@Supelec](https://www.ruby-forum.com/u/Supelec)\
**Post date:** [March 10, 2022, 12:38pm UTC](https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576/1 "2022-03-10T12:38:02Z")

</div>

Hi,

I would like to put a security through Ruby-sinatra code.  
Do exist the specific gem to install in order to secure the code ?  
Thanks by advance.

Supelec

---

<div class="post-metadata">

**Author:** ![SouravGoswami](https://www.ruby-forum.com/user_avatar/www.ruby-forum.com/souravgoswami/32/2543_2.png) [@SouravGoswami](https://www.ruby-forum.com/u/SouravGoswami)\
**Post date:** [March 11, 2022, 8:33pm UTC](https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576/2 "2022-03-11T20:33:05Z")

</div>

Why don’t you just use ActiveRecord?

Here are the steps to setup ActiveRecord:

> <https://gist.github.com/jtallant/fd66db19e078809dfe94401a0fc814d2>

I’m suggesting active record because it’s used by a lot of people and it’s tested against SQL injection.

To keep things safe, I also suggest you updating this gem on gemfile once it’s updated!

---

<div class="post-metadata">

**Author:** ![Aune1994](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/22d042/32.png) [@Aune1994](https://www.ruby-forum.com/u/Aune1994)\
**Post date:** [March 12, 2022, 5:09am UTC](https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576/3 "2022-03-12T05:09:43Z")

</div>

1. Use param\_hash instead of using params hash  
Using param\_hash will prevent SQL Injection attack. I had seen this in some popular websites like [facebook.com](http://facebook.com) etc.
2. Sinatra uses Rack::MockRequest to handle your request. You can use this mock request to check if parameters are passed correctly or not.  
mock\_request rack::mock\_request()  
response mock\_request.get(‘/’, {‘a’: ‘b’})  
If its false then something went wrong from client side.

---

<div class="post-metadata">

**Author:** ![Supelec](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d6d6ee/32.png) [@Supelec](https://www.ruby-forum.com/u/Supelec)\
**Post date:** [March 14, 2022, 5:22pm UTC](https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576/4 "2022-03-14T17:22:49Z")

</div>

Hello,

Thank you for your help !

I will implement the test.

Best regards,

Supelec

---

<div class="post-metadata">

**Author:** ![Supelec](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d6d6ee/32.png) [@Supelec](https://www.ruby-forum.com/u/Supelec)\
**Post date:** [March 14, 2022, 5:23pm UTC](https://www.ruby-forum.com/t/how-to-secure-code-against-sql-injection-on-ruby-sinatra/262576/5 "2022-03-14T17:23:31Z")

</div>

Hello,

Thank you very much for your suggestion.

Best regards,

Supelec