# Parameter validation and other security measures

**URL:** <https://www.ruby-forum.com/t/parameter-validation-and-other-security-measures/155458>\
**Category:** Rails\
**Created:** [December 12, 2008, 1:45am UTC](https://www.ruby-forum.com/t/parameter-validation-and-other-security-measures/155458 "2008-12-12T01:45:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\
**Post date:** [December 12, 2008, 1:45am UTC](https://www.ruby-forum.com/t/parameter-validation-and-other-security-measures/155458/1 "2008-12-12T01:45:01Z")

</div>

We have a site that receives about 30000 uniques per month. Lately, we  
have been hit with URLs that are hundreds of characters long with all  
sort of junk in the URL/parameters. I suspect this is an attempt at  
session hijacking or something similar. At a minimum, it fills up our  
log files and generates undesirable email alerts.

I began reading up on Rails security here:  
[rails.info](http://guides.rails.info/security.html) and also looking into stuff like  
[http://www.hoptoadapp.com/welcome](http://www.hoptoadapp.com/welcome).

My question here is: what is a good way to validate “params” in rails  
apps to handle SQL injections, etc.?

I’m considering writing some common routines to validate the param type,  
min/max length, detect SQL keywords, etc. but didn’t want to reinvent  
the wheel if there is already stuff out there (e.g. plugins).

Thanks in advance.