# Is this SQL possible with Rails? How can I sanitize?

**URL:** <https://www.ruby-forum.com/t/is-this-sql-possible-with-rails-how-can-i-sanitize/183002>\
**Category:** Rails\
**Created:** [February 5, 2010, 8:09pm UTC](https://www.ruby-forum.com/t/is-this-sql-possible-with-rails-how-can-i-sanitize/183002 "2010-02-05T20:09:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [February 5, 2010, 8:09pm UTC](https://www.ruby-forum.com/t/is-this-sql-possible-with-rails-how-can-i-sanitize/183002/1 "2010-02-05T20:09:15Z")

</div>

I want to do something like this in Rails:  
“SELECT \*, COUNT(post\_id) AS total FROM comments … conditions”

Is that SELECT possible in Rails. Ohterwise, I can use find\_by\_sql, but  
i’m trying to avoid SQL injection and this SQL needs a parameter. Is  
there a way to sanitize this parameter?

I’ll appreciate any help

---

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [February 5, 2010, 8:31pm UTC](https://www.ruby-forum.com/t/is-this-sql-possible-with-rails-how-can-i-sanitize/183002/2 "2010-02-05T20:31:56Z")

</div>

On Feb 5, 2:09 pm, John S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I want to do something like this in Rails:  
> “SELECT \*, COUNT(post\_id) AS total FROM comments … conditions”
> 
> Is that SELECT possible in Rails. Ohterwise, I can use find\_by\_sql, but  
> i’m trying to avoid SQL injection and this SQL needs a parameter. Is  
> there a way to sanitize this parameter?
> 
> ## I’ll appreciate any help
> 
> Posted viahttp://www.ruby-forum.com/.

“You can use the same string replacement techniques as you can with  
ActiveRecord#find.”

> **[ActiveRecord::Base](https://api.rubyonrails.org/classes/ActiveRecord/Base.html#M002267)**
>
> Active Record Active Record objects don't specify their attributes directly, but rather infer them from the table definition with which they're linked.

alternatively, does :select =\> “\*, COUNT(post\_id) AS total” in your  
Comments.find work?

---

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [February 5, 2010, 9:46pm UTC](https://www.ruby-forum.com/t/is-this-sql-possible-with-rails-how-can-i-sanitize/183002/3 "2010-02-05T21:46:54Z")

</div>

Thanks a lot, find\_by\_sql worked! I tried to do the same, but I did not  
use the []. I tried :select =\> … also before asking, but that did not  
work.

pharrington wrote:

> On Feb 5, 2:09�pm, John S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > I want to do something like this in Rails:  
> > “SELECT \*, COUNT(post\_id) AS total FROM comments … conditions”
> > 
> > Is that SELECT possible in Rails. Ohterwise, I can use find\_by\_sql, but  
> > i’m trying to avoid SQL injection and this SQL needs a parameter. Is  
> > there a way to sanitize this parameter?
> > 
> > ## I’ll appreciate any help
> > 
> > Posted viahttp://www.ruby-forum.com/.
> 
> “You can use the same string replacement techniques as you can with  
> ActiveRecord#find.”
> 
> [ActiveRecord::Base](http://api.rubyonrails.org/classes/ActiveRecord/Base.html#M002267)
> 
> alternatively, does :select =\> “\*, COUNT(post\_id) AS total” in your  
> Comments.find work?

---

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [February 5, 2010, 9:56pm UTC](https://www.ruby-forum.com/t/is-this-sql-possible-with-rails-how-can-i-sanitize/183002/4 "2010-02-05T21:56:30Z")

</div>

> I tried :select =\> … also before asking, but that did not work.  
> Mind showing us the query? It should work I belive…