# Sanitize SQL?

**URL:** <https://www.ruby-forum.com/t/sanitize-sql/147034>\
**Category:** Rails\
**Created:** [August 27, 2008, 8:17pm UTC](https://www.ruby-forum.com/t/sanitize-sql/147034 "2008-08-27T20:17:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Clinton\_Judy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/41988e/32.png) [@Clinton\_Judy](https://www.ruby-forum.com/u/Clinton_Judy)\
**Post date:** [August 27, 2008, 8:17pm UTC](https://www.ruby-forum.com/t/sanitize-sql/147034/1 "2008-08-27T20:17:13Z")

</div>

I have the following code in my model, that executes a stored procedure:

```
    connection.execute "exec PS_SaveData ?, ?, ?, ?, ?, ?, ?, ?, ?, 

```

?,  
?, ?, ?, ?, ?",  
day.to\_s, crew\_leader.to\_s,  
dayshiftyn.to\_s,  
numtrucks.to\_s,  
numrounds.to\_s, numdigouts.to\_s,  
shuttlebuggyyn.to\_s, notes.to\_s,  
jobid.to\_s, sequence.to\_s, material.to\_s,  
oil.to\_s, tons.to\_s,  
plant.to\_s, site.to\_s

It doesn’t work, because connection.execute just wants the SQL string to  
be  
passed to it. I’m also looking at this code in ActiveRecord::Base, in an  
attempt to see how Rails sanitizes sql…

581: def find\_by\_sql(sql)  
582: connection.select\_all(sanitize\_sql(sql), “#{name}  
Load”).collect! { |record| instantiate(record) }  
583: end

But I’m not sure how to apply it to my code above. Help?

TIA,

- Clinton

---

<div class="post-metadata">

**Author:** ![Clinton\_Judy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/41988e/32.png) [@Clinton\_Judy](https://www.ruby-forum.com/u/Clinton_Judy)\
**Post date:** [August 27, 2008, 8:42pm UTC](https://www.ruby-forum.com/t/sanitize-sql/147034/2 "2008-08-27T20:42:27Z")

</div>

On 27 Aug 2008, at 19:16, “Clinton Judy” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> ```
> jobid.to_s, sequence.to_s,  
> 
> ```
> 
> 582: connection.select\_all(sanitize\_sql(sql), “#{name}  
> Load”).collect! { |record| instantiate(record) }
> 
> 583: end
> 
> But I’m not sure how to apply it to my code above. Help?

The sanitize\_sql function just wants an array whose first element is  
an SQL fragment and the following ones the variables to be inserted.

Fred

---

<div class="post-metadata">

**Author:** ![Clinton\_Judy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/41988e/32.png) [@Clinton\_Judy](https://www.ruby-forum.com/u/Clinton_Judy)\
**Post date:** [August 27, 2008, 10:01pm UTC](https://www.ruby-forum.com/t/sanitize-sql/147034/3 "2008-08-27T22:01:03Z")

</div>

Thanks! I got it working here.

```
    sql = ["exec PS_SaveData ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 

```

?,  
?",  
day.to\_s, crew\_leader.to\_s, dayshiftyn.to\_s,  
numtrucks.to\_s,  
numrounds.to\_s, numdigouts.to\_s, shuttlebuggyyn.to\_s,  
notes.to\_s,  
jobid.to\_s, sequence.to\_s, material.to\_s, oil.to\_s,  
tons.to\_s,  
plant.to\_s, site.to\_s]

```
    connection.execute(sanitize_sql(sql))

```

On Wed, Aug 27, 2008 at 2:41 PM, Frederick C. \<