# Injection attacks

**URL:** <https://www.ruby-forum.com/t/injection-attacks/139989>\
**Category:** Rails\
**Created:** [June 9, 2008, 8:51pm UTC](https://www.ruby-forum.com/t/injection-attacks/139989 "2008-06-09T20:51:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [June 9, 2008, 8:51pm UTC](https://www.ruby-forum.com/t/injection-attacks/139989/1 "2008-06-09T20:51:37Z")

</div>

Hi,

I have this pice of SQL, in my ROR app

I have two models article and category, and I’m trying to do a search  
of public articles in a selected category. I am using a find\_by\_sql,  
and this leaves me open to an injection attack.

We get the input parameter #{@search\_term} from the user, they type  
this in so it can be any thing.  
#{@selected\_catID}, #{article\_per\_page}, #{article\_offset} will be  
int’s

@public\_ articles = Article.find\_by\_sql(“SELECT articles.\* FROM  
articles, articles\_categories ac  
WHERE articles.is\_public = 1 and articles.id=ac.  
article\_id and ac.category\_id=#{@selected\_catID} and  
(articles.description like ‘%#{@search\_term}%’ or article.title like  
‘%#{@search\_term}%’)  
order by created\_at DESC LIMIT #{article\_per\_page}  
OFFSET #{article\_offset}”)

What is the correct way to do this?

Kind regards,  
Dave.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [June 9, 2008, 9:04pm UTC](https://www.ruby-forum.com/t/injection-attacks/139989/2 "2008-06-09T21:04:36Z")

</div>

removed\_email\_address@domain.invalid wrote:

> #{@selected\_catID}, #{article\_per\_page}, #{article\_offset} will be
> 
> What is the correct way to do this?

I’ll assume that articles\_categories is a HABTM table between ‘articles’  
and ‘categories’ tables.

Article.find(:all, :include =\> :categories, :conditions =\>  
[“articles.is\_public = 1 AND categories.id = ? AND (articles.description  
LIKE ? OR articles.title LIKE ?”,@selected\_catID,  
“%#{search\_term}%”,“%#{search\_term}%”], :order =\> ‘created\_at DESC’,  
:limit =\> articles\_per\_page, :offset =\> articles\_offset)

–

[http://www.5valleys.com/](http://www.5valleys.com/)

[http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [June 9, 2008, 9:06pm UTC](https://www.ruby-forum.com/t/injection-attacks/139989/3 "2008-06-09T21:06:22Z")

</div>

On Jun 9, 8:04 pm, Jon G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> removed\_email\_address@domain.invalid wrote:
> 
> > Hi,
> 
> I’ll assume that articles\_categories is a HABTM table between ‘articles’  
> and ‘categories’ tables.
> 
> Article.find(:all, :include =\> :categories, :conditions =\>  
> Or just :joins if you don’t actually want to load the categories.

Fred

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [June 9, 2008, 9:08pm UTC](https://www.ruby-forum.com/t/injection-attacks/139989/4 "2008-06-09T21:08:43Z")

</div>

Jon G. wrote:

> > this in so it can be any thing.  
> > OFFSET #{article\_offset}“)  
> > (articles.description LIKE ? OR articles.title LIKE  
> > ?”,@selected\_catID, “%#{search\_term}%”,“%#{search\_term}%”], :order =\>  
> > ‘created\_at DESC’, :limit =\> articles\_per\_page, :offset =\>  
> > articles\_offset)

Actully, no, the is much better.

@category = Category.find(@selected\_catID)  
@articles = @category.articles.find(:all, :conditions =\>  
[“articles.is\_public = 1 AND (articles.description LIKE ? OR  
articles.title LIKE ?”, “%#{search\_term}%”,“%#{search\_term}%”], :order  
=\> ‘created\_at DESC’, :limit =\> articles\_per\_page, :offset =\>  
articles\_offset)

–

[http://www.5valleys.com/](http://www.5valleys.com/)

[http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [June 10, 2008, 11:47am UTC](https://www.ruby-forum.com/t/injection-attacks/139989/5 "2008-06-10T11:47:47Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

On Monday 09 June 2008 21:08:13 Jon G. wrote:

> @category = Category.find(@selected\_catID)  
> @articles = @category.articles.find(:all, :conditions =\>  
> [“articles.is\_public = 1 AND (articles.description LIKE ? OR  
> articles.title LIKE ?”, “%#{search\_term}%”,"%#{search\_term}%"],  
> :order =\> ‘created\_at DESC’, :limit =\> articles\_per\_page, :offset =\>  
> articles\_offset)

I think that if you parametize the is\_public value, ActiveRecord copes  
with various SQL boolean approaches:

[“articles.is\_public = ? …”, true, …]

Ciao,  
Sheldon.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFITk2GpGJX8XSgas0RAmB+AJ0RodtZH7w7LGFlOhVN4OLmuE33UACfTl0c  
gLVfrMz/BNpo+TcA/BH83G0=  
=ekpk  
-----END PGP SIGNATURE-----