# Sql injection

**URL:** <https://www.ruby-forum.com/t/sql-injection/100194>\
**Category:** Rails\
**Created:** [December 13, 2005, 4:32pm UTC](https://www.ruby-forum.com/t/sql-injection/100194 "2005-12-13T16:32:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 13, 2005, 4:32pm UTC](https://www.ruby-forum.com/t/sql-injection/100194/1 "2005-12-13T16:32:33Z")

</div>

hi,  
I want to create an sql condition like “date=? AND  
published=?”,date,published like I can do in :conditions=\> hash. but  
couldnt  
find a method for doing it in a standalone string; I mean outside find  
by  
sql or :conditions. how can I do that?  
thanks in advance

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 13, 2005, 5:47pm UTC](https://www.ruby-forum.com/t/sql-injection/100194/2 "2005-12-13T17:47:32Z")

</div>

Is this what you want?

sql = “date = #{date} AND published=#{published}”

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 13, 2005, 5:53pm UTC](https://www.ruby-forum.com/t/sql-injection/100194/3 "2005-12-13T17:53:52Z")

</div>

use methods ‘quote’ or ‘sanitize’

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 13, 2005, 6:54pm UTC](https://www.ruby-forum.com/t/sql-injection/100194/4 "2005-12-13T18:54:28Z")

</div>

I just got done reviewing some of the info in the ferret wiki. It looks  
like  
some great work - thanks!

I’m building an app that is going have some search capability and I was  
planning  
on using mysql with fulltext searches, but looking at ferret has got me  
wondering if there might not be a better way.

Specifically, I was wondering about the idea of using an in memory index  
for  
increasing the speed of searches.

The data i’m storing will be most utilized when it is relatively new.  
After it’s  
a few days old, people won’t need it as much. So putting all this data  
in the  
same database may not make sense (if it’s relatively easy to split it  
into  
‘fresh’ and ‘stale’ databases).

Would it make sense to consider using an in-memory cache of documents  
for the  
newest data while having a disk-based index for when people want to  
search for  
older documents? Or would the performance gains not be worth the effort?

-kevin

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 17, 2005, 1:41pm UTC](https://www.ruby-forum.com/t/sql-injection/100194/5 "2005-12-17T13:41:54Z")

</div>

:conditions =\> [“date = ? and published = ?”, date, published]

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 17, 2005, 1:41pm UTC](https://www.ruby-forum.com/t/sql-injection/100194/6 "2005-12-17T13:41:55Z")

</div>

I wanted to mean, how can I make this replacement except using  
:conditions.  
outside the query.