# Parsing Ruby code from database possible?

**URL:** <https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525>\
**Category:** Rails\
**Created:** [October 6, 2007, 8:59pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525 "2007-10-06T20:59:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 8:59pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/1 "2007-10-06T20:59:27Z")

</div>

Security concerns aside, if I want to let the user write Rails code to  
my MySql database (e.g. \<%= "Hello world %\>, and the application would  
then parse the code, would that be possible?

---

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 9:10pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/2 "2007-10-06T21:10:02Z")

</div>

On Sat, 6 Oct 2007 20:59:27 +0200, Bob S. wrote:

> Security concerns aside, if I want to let the user write Rails code to  
> my MySql database (e.g. \<%= "Hello world %\>, and the application would  
> then parse the code, would that be possible?

Sure:

class MyModel \< ActiveRecord::Base  
def do\_something\_dangerous  
eval self.a\_text\_field\_containing\_ruby\_code  
end  
end

–  
Jay L. |  
Boston, MA | My character doesn’t like it when they  
Faster: jay at jay dot fm | cry or shout or hit.  
[http://www.jay.fm](http://www.jay.fm) | - Kristoffer

---

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 9:12pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/3 "2007-10-06T21:12:37Z")

</div>

Thanks a bunch, Jay! That was fast 🙂

---

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 9:15pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/4 "2007-10-06T21:15:28Z")

</div>

Hi Jody!

That was what I thought might work too 🙂 Thanks for the great advice. I  
actually just installed the liquid plugin before I saw your post, and  
I’ll look into Mephisto.

Thanks a bunch again for the fabulous advice, Jody.

---

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 9:17pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/5 "2007-10-06T21:17:09Z")

</div>

…and I can’t believe I just spelled your name incorrectly, Jodi 😉

---

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 9:25pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/6 "2007-10-06T21:25:50Z")

</div>

Bob -

On 6-Oct-07, at 3:15 PM, Bob S. wrote:

> Hi Jody!
> 
> That was what I thought might work too 🙂 Thanks for the great  
> advice. I  
> actually just installed the liquid plugin before I saw your post, and  
> I’ll look into Mephisto.

After writing I realized that depending on your needs there might be  
another option - I’m looking at this option right now.

If you’re not doing templating, FFSB[1] (\_why’s FreakyFreaky Sandbox)  
might be an option.

Fully ruby sandboxed syntax - not geared to templates though. The  
syntax is much sweeter though - the ruby we love - I’ve found liquid  
syntax to be a bit paintful but certainly a good solution for end  
user templating.

Unfortunately there hasn’t been a commit to FFSB since late 2006.  
I’ve presently asked \_why the status - no response yet.

(and np on the spelling. common mistake. Mom was a hippy who loved  
boys with girls names err spellings)

Jodi  
[1] [http://code.whytheluckystiff.net/sandbox/](http://code.whytheluckystiff.net/sandbox/)

---

<div class="post-metadata">

**Author:** ![adistarmid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@adistarmid](https://www.ruby-forum.com/u/adistarmid)\
**Post date:** [October 6, 2007, 9:10pm UTC](https://www.ruby-forum.com/t/parsing-ruby-code-from-database-possible/116525/7 "2007-10-06T21:10:38Z")

</div>

Howdy Bob -

On 6-Oct-07, at 2:59 PM, Bob S. wrote:

> Security concerns aside, if I want to let the user write Rails code to  
> my MySql database (e.g. \<%= "Hello world %\>, and the application would  
> then parse the code, would that be possible?

(warning "not what you asked, but imo a better solution to user  
generated content)

I have implemented such a feature for email templates using the  
liquid templating engine.

You can benefit from flow control, operators and sandboxing.

Good resources are:

> **[Liquid template language](https://shopify.github.io/liquid/)**
>
> Documentation for the Liquid template language, created by Shopify.

[http://mephistoblog.com/](http://mephistoblog.com/) (look at the mephisto source for  
implementation)

providing a context to liquid is the toughest part; not so tough -  
just need to explicitly tell liquid what objects, attributes  
associations are avail.

Let me know if a bit of code can help you move forward.

cheers,  
Jodi