# Ruby, MySQL, and apostrophe problem

**URL:** <https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840>\
**Category:** Ruby\
**Created:** [February 12, 2008, 2:05am UTC](https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840 "2008-02-12T02:05:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\
**Post date:** [February 12, 2008, 2:05am UTC](https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840/1 "2008-02-12T02:05:52Z")

</div>

I’m building a website for a university class that allows users to  
submit links (though not “rank” them) a la Digg. The entire page is  
built on a CGI script and uses HTML input fields, as well as a textarea.

Everything seems to work fine, except that if a user inputs an  
apostrophe in any field of the form, the script breaks.

Is there some way of handling this, or do I need to warn people to not  
use conjunctions or possessives?

Thanks so much.

---

<div class="post-metadata">

**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\
**Post date:** [February 12, 2008, 2:12am UTC](https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840/2 "2008-02-12T02:12:46Z")

</div>

On 2/11/08, Mark A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I’m building a website for a university class that allows users to  
> submit links (though not “rank” them) a la Digg. The entire page is  
> built on a CGI script and uses HTML input fields, as well as a textarea.
> 
> Everything seems to work fine, except that if a user inputs an  
> apostrophe in any field of the form, the script breaks.
> 
> Is there some way of handling this, or do I need to warn people to not  
> use conjunctions or possessives?

Escape any user-supplied data you put into a SQL query.

Google up on SQL injection for more.

Best,  
jeremy

---

<div class="post-metadata">

**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\
**Post date:** [February 12, 2008, 2:23am UTC](https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840/3 "2008-02-12T02:23:54Z")

</div>

Jeremy K. wrote:

> On 2/11/08, Mark A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > I’m building a website for a university class that allows users to  
> > submit links (though not “rank” them) a la Digg. The entire page is  
> > built on a CGI script and uses HTML input fields, as well as a textarea.
> > 
> > Everything seems to work fine, except that if a user inputs an  
> > apostrophe in any field of the form, the script breaks.
> > 
> > Is there some way of handling this, or do I need to warn people to not  
> > use conjunctions or possessives?
> 
> Escape any user-supplied data you put into a SQL query.
> 
> Google up on SQL injection for more.
> 
> Best,  
> jeremy

Sorry, but how exactly do I escape the data?

Basically, the code is this

description = $cgi[‘description’]

HTML stuff

puts #{description#}

Thanks again.

---

<div class="post-metadata">

**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\
**Post date:** [February 12, 2008, 2:27am UTC](https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840/4 "2008-02-12T02:27:27Z")

</div>

On 2/11/08, Mark A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > > use conjunctions or possessives?  
> > > Basically, the code is this
> 
> description = $cgi[‘description’]
> 
> HTML stuff
> 
> puts #{description#}

You need to investigate this and figure it out yourself, my friend 🙂

jeremy

---

<div class="post-metadata">

**Author:** ![larios](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/bc79bd/32.png) [@larios](https://www.ruby-forum.com/u/larios)\
**Post date:** [February 12, 2008, 6:46am UTC](https://www.ruby-forum.com/t/ruby-mysql-and-apostrophe-problem/128840/5 "2008-02-12T06:46:45Z")

</div>

> Is there some way of handling this, or do I need to warn people to not  
> use conjunctions or possessives?

Just use Sequel and forget about SQL injection:

[http://sequel.rubyforge.org](http://sequel.rubyforge.org)

If you need more help we are here:

[http://groups.google.com/group/sequel-talk](http://groups.google.com/group/sequel-talk)

best  
sharon