# How to use strings as code

**URL:** <https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275>\
**Category:** Ruby\
**Created:** [June 8, 2007, 12:49am UTC](https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275 "2007-06-08T00:49:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![riv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a9a28c/32.png) [@riv](https://www.ruby-forum.com/u/riv)\
**Post date:** [June 8, 2007, 12:49am UTC](https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275/1 "2007-06-08T00:49:50Z")

</div>

In short, I’m looking for a way to grab a string from a database and use  
it as code in my rails app. I understand the security implications, but  
it’s still what I want to do (and I don’t know what other options I  
have!).

I have an ecommerce site that I’m working on, and I want users to be  
able to narrow search results using filters. The filters are set up in  
the database so that each has a filter\_key and filter\_value. These are  
added to a hash that then fetches items that meet the desired criteria.  
Specifically, here’s what it looks like:

@active\_filters.each\_value do |a|  
@filters[a.filter\_key] = a.filter\_value  
end

@active\_filters is a hash. @filters is used in the item lookup  
elsewhere. In the database, one filter\_key is “our\_price” (also a  
column in the items table), and the corresponding value is a range:  
101…300. If I put the range into the code directly, the item lookup  
contains a “WHERE items.`our_price` BETWEEN 101 AND 300” statement.  
However, when the filter\_value is returned, the statement is “WHERE  
items.`our_price` = ‘101…300’”, obviously not what I’m looking for.

Does anybody have any suggestions for how to do this? …or what I  
should be doing instead? I really appreciate. My first “real” rails  
app has grown into a monster!

Thanks.

-Kyle

---

<div class="post-metadata">

**Author:** ![riv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a9a28c/32.png) [@riv](https://www.ruby-forum.com/u/riv)\
**Post date:** [June 8, 2007, 2:38am UTC](https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275/2 "2007-06-08T02:38:01Z")

</div>

On 6/7/07, Kyle R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> In short, I’m looking for a way to grab a string from a database and use it as code in my rails app. I understand the security implications, but it’s still what I want to do (and I don’t know what other options I have!).

it’s pretty easy, but I wouldn’t recommend doing it.

string = “p ‘hello world’”  
eval(string)

> I have an ecommerce site that I’m working on, and I want users to be able to narrow search results using filters. The filters are set up in the database so that each has a filter\_key and filter\_value. These are added to a hash that then fetches items that meet the desired criteria. Specifically, here’s what it looks like:
> 
> @active\_filters.each\_value do |a|  
> @filters[a.filter\_key] = a.filter\_value  
> end
> 
> @active\_filters is a hash. @filters is used in the item lookup elsewhere. In the database, one filter\_key is “our\_price” (also a column in the items table), and the corresponding value is a range: 101…300. If I put the range into the code directly, the item lookup contains a “WHERE items.`our_price` BETWEEN 101 AND 300” statement. However, when the filter\_value is returned, the statement is “WHERE items.`our_price` = ‘101…300’”, obviously not what I’m looking for.
> 
> Does anybody have any suggestions for how to do this? …or what I should be doing instead? I really appreciate. My first “real” rails app has grown into a monster!

This is a Rails question and probably would find a happier home on the  
Rails list. In fact the answer I gave you above has literally nothing  
to do with your question, because it’s not a Ruby eval you want but a  
SQL eval. I still wouldn’t recommend using eval, though. What you  
really want is a clearer understanding of how databases work in  
general and how Rails builds SQL in particular.

Alternatively, both Duane J. and Jay Fields are building SQL DSLs  
for Rails in Ruby, and either one of these could give you much less  
stressful ways of building the SQL, if Rails’ SQL-building stresses  
you out. But again this is totally a thing for the Rails list, you’re  
in the wrong part of town for this kind of thing.

–  
Giles B.

Blog: [http://gilesbowkett.blogspot.com](http://gilesbowkett.blogspot.com)  
Portfolio: [http://www.gilesgoatboy.org](http://www.gilesgoatboy.org)

---

<div class="post-metadata">

**Author:** ![riv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a9a28c/32.png) [@riv](https://www.ruby-forum.com/u/riv)\
**Post date:** [June 8, 2007, 1:27pm UTC](https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275/3 "2007-06-08T13:27:12Z")

</div>

Hi –

On Fri, 8 Jun 2007, Robert K. wrote:

> > eval(string)  
> > raise “Filter Error: #{filter}”  
> > end  
> > end

Another thought would be to store the ranges as non-code data, in  
their own table – basically two integers per record – and then  
construct the range dynamically (but just using regular range syntax,  
without eval) from those values.

David

---

<div class="post-metadata">

**Author:** ![riv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a9a28c/32.png) [@riv](https://www.ruby-forum.com/u/riv)\
**Post date:** [June 8, 2007, 12:30pm UTC](https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275/4 "2007-06-08T12:30:56Z")

</div>

On 08.06.2007 02:36, Giles B. wrote:

> On 6/7/07, Kyle R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > In short, I’m looking for a way to grab a string from a database and  
> > use it as code in my rails app. I understand the security  
> > implications, but it’s still what I want to do (and I don’t know what  
> > other options I have!).
> 
> it’s pretty easy, but I wouldn’t recommend doing it.
> 
> string = “p ‘hello world’”  
> eval(string)

To make it safer, he could do some checks to verify the filter is legal,  
something like

def convert(filter)  
case filter  
when /\A\d+.{2,3}\d+\z/, /\A[±]?\d+\z/  
eval filter  
…  
else  
raise “Filter Error: #{filter}”  
end  
end

Kind regards

robert

---

<div class="post-metadata">

**Author:** ![riv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a9a28c/32.png) [@riv](https://www.ruby-forum.com/u/riv)\
**Post date:** [June 8, 2007, 4:46pm UTC](https://www.ruby-forum.com/t/how-to-use-strings-as-code/106275/5 "2007-06-08T16:46:38Z")

</div>

Wow, I appreciate all of the quick responses! I asked here because I  
figured converting a string into active code was more of a Ruby than a  
Rails thing, but I see how it could have been better put to the Rails  
lists.

Thanks again!

-Kyle