# Querying MySQL from a select box form

**URL:** <https://www.ruby-forum.com/t/querying-mysql-from-a-select-box-form/106671>\
**Category:** Ruby\
**Created:** [June 13, 2007, 3:29am UTC](https://www.ruby-forum.com/t/querying-mysql-from-a-select-box-form/106671 "2007-06-13T03:29:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brandon\_Robison](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8edcca/32.png) [@Brandon\_Robison](https://www.ruby-forum.com/u/Brandon_Robison)\
**Post date:** [June 13, 2007, 3:29am UTC](https://www.ruby-forum.com/t/querying-mysql-from-a-select-box-form/106671/1 "2007-06-13T03:29:24Z")

</div>

I don’t even know how to explain the weirdness of this one except to  
show the query it’s making when it displays the error

> **[Pololu - Custom Laser Cutting Service](https://www.pololu.com/product/749)**
>
> Our laser cutting service is ideal for making custom parts out of various sheet materials. Pricing starts at $25, and most orders ship in three business days. We also offer expedited services, up to our same-day service; local customers can pick up...

Scroll down to the yellow “Materials search too” box and try selecting,  
say… black AND black top white core (under colors). Normally the query  
uses IN, not LIKE, but so I could see the query, I made it like that.

Notice how it puts %2520 for spaces (or %252F for /)? It messes up the  
query, obviously. How would I tell it to output a " " instead of %2520?

Also, it only does it when multiple items are selected. If you select  
JUST one item with spaces, it works

Ruby code: [Parked at Loopia](http://pastie.caboo.se/69978)  
Select boxes: [Parked at Loopia](http://pastie.caboo.se/69979)

Any help with this would be greatly appreciated! Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Brandon\_Robison](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8edcca/32.png) [@Brandon\_Robison](https://www.ruby-forum.com/u/Brandon_Robison)\
**Post date:** [June 13, 2007, 4:38am UTC](https://www.ruby-forum.com/t/querying-mysql-from-a-select-box-form/106671/2 "2007-06-13T04:38:07Z")

</div>

Brandon Robison wrote:

> query, obviously. How would I tell it to output a " " instead of %2520?
> 
> Also, it only does it when multiple items are selected. If you select  
> JUST one item with spaces, it works
> 
> Ruby code: [Parked at Loopia](http://pastie.caboo.se/69978)  
> Select boxes: [Parked at Loopia](http://pastie.caboo.se/69979)
> 
> Any help with this would be greatly appreciated! Thanks in advance.

(Sorry–this may be a double send.)  
Brandon,

I notice that when a space is converted to URL characters, it becomes  
%20. When a percent sign is converted, it becomes %25. So you get %2520  
when you attempt to convert " " twice: " " → “%20” → “%2520”

The same is true of the conversion for “/”.

I don’t see where these conversions are taking place, but knowing what’s  
wrong may be enough for you to find it. However, I think something else  
is wrong with your queries, because selecting two items never seems to  
work, regardless of whether they contain spaces.

Dan

---

<div class="post-metadata">

**Author:** ![Brandon\_Robison](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/8edcca/32.png) [@Brandon\_Robison](https://www.ruby-forum.com/u/Brandon_Robison)\
**Post date:** [June 13, 2007, 9:54pm UTC](https://www.ruby-forum.com/t/querying-mysql-from-a-select-box-form/106671/3 "2007-06-13T21:54:26Z")

</div>

On the security side of things you might want to code some input  
validation  
routines. I can’t see all of your code or the back parts of it but it  
appears that you might be leaving yourself open to SQL injection  
attacks.

- Nathan