# Sanitize my params and the create method

**URL:** <https://www.ruby-forum.com/t/sanitize-my-params-and-the-create-method/112766>\
**Category:** Rails\
**Created:** [August 23, 2007, 12:35am UTC](https://www.ruby-forum.com/t/sanitize-my-params-and-the-create-method/112766 "2007-08-23T00:35:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aantix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f0a364/32.png) [@aantix](https://www.ruby-forum.com/u/aantix)\
**Post date:** [August 23, 2007, 12:35am UTC](https://www.ruby-forum.com/t/sanitize-my-params-and-the-create-method/112766/1 "2007-08-23T00:35:03Z")

</div>

If I call .create on the param structure, are the parameters being  
passed to the create method automatically sanitized for me?

e.g. Journalentry.create(param[:journalentry])

Do I have to worry about any malicious scripting making its way into the  
creation of the record?

Thanks.

---

<div class="post-metadata">

**Author:** ![aantix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f0a364/32.png) [@aantix](https://www.ruby-forum.com/u/aantix)\
**Post date:** [August 23, 2007, 12:48am UTC](https://www.ruby-forum.com/t/sanitize-my-params-and-the-create-method/112766/2 "2007-08-23T00:48:27Z")

</div>

On 8/22/07, Jim J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> If I call .create on the param structure, are the parameters being  
> passed to the create method automatically sanitized for me?
> 
> e.g. Journalentry.create(param[:journalentry])
> 
> Do I have to worry about any malicious scripting making its way into the  
> creation of the record?

Yes, all values passed to create() are properly quoted for insertion  
into the database, so you’re protected from SQL injection attacks.

However, they are not “sanitized” beyond that, so you need to of  
course be careful when you send them back to the view to properly  
escape them. This is obviously not the bailiwick of ActiveRecord…

---

<div class="post-metadata">

**Author:** ![aantix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f0a364/32.png) [@aantix](https://www.ruby-forum.com/u/aantix)\
**Post date:** [September 5, 2007, 11:44pm UTC](https://www.ruby-forum.com/t/sanitize-my-params-and-the-create-method/112766/3 "2007-09-05T23:44:51Z")

</div>

Bob S. wrote:

> Yes, all values passed to create() are properly quoted for insertion  
> into the database, so you’re protected from SQL injection attacks.

I have users created with User.create(params[:form]) and this is secure  
(in terms of SQL injection), right? So how I should find user by email  
using find with :conditions?

Create method does not escape @ sign, but :conditions =\> [“email = ?”,  
params[:email]]) does escape, so user@domain (inserted to DB by create  
method) is something different than user%40domain (queried by find with  
:conditions).

I wonder how properly create :conditions statement. Of course  
User.find\_by\_email is secure (escapes ') and finds email since it does  
not escape @, but how to create more complicated queries with  
:conditions and be SQL injection safe?

## Best regards,

Witold R.  
[http://nhw.pl/wp/](http://nhw.pl/wp/) (EN blog)  
[http://FriendsFeedMe.com](http://FriendsFeedMe.com)