# Sitealizer plugin vulnerable to SQL injections?

**URL:** <https://www.ruby-forum.com/t/sitealizer-plugin-vulnerable-to-sql-injections/108641>\
**Category:** Rails\
**Created:** [July 5, 2007, 3:51pm UTC](https://www.ruby-forum.com/t/sitealizer-plugin-vulnerable-to-sql-injections/108641 "2007-07-05T15:51:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zargony](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/5e9695/32.png) [@Zargony](https://www.ruby-forum.com/u/Zargony)\
**Post date:** [July 5, 2007, 3:51pm UTC](https://www.ruby-forum.com/t/sitealizer-plugin-vulnerable-to-sql-injections/108641/1 "2007-07-05T15:51:22Z")

</div>

> From what I’ve seen after quickly browsing through the sitealizer  
> ([http://sitealizer.rubyforge.org/](http://sitealizer.rubyforge.org/)) source, it’ll make the whole  
> application vulnerable to SQL-injection attacks. All HTTP params are  
> passed directly into SQL calls without quoting.