# Sql injection

**URL:** <https://www.ruby-forum.com/t/sql-injection/93942>\
**Category:** Rails\
**Created:** [April 15, 2006, 5:59pm UTC](https://www.ruby-forum.com/t/sql-injection/93942 "2006-04-15T17:59:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 15, 2006, 5:59pm UTC](https://www.ruby-forum.com/t/sql-injection/93942/1 "2006-04-15T17:59:33Z")

</div>

Hi,  
All through my current project, I’ve been assuming that rails is  
clever enough to prevent SQL injections automatically. Is this right?  
If not, what’s the best way of doing it?  
-Nathan

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 15, 2006, 6:05pm UTC](https://www.ruby-forum.com/t/sql-injection/93942/2 "2006-04-15T18:05:47Z")

</div>

Nathan  
\>rails … SQL injections  
\> If not, what’s the best way of doing it?

Google(rails sql injection)  
=\> [Peak Obsession](http://manuals.rubyonrails.com/read/chapter/43)

Alain

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 15, 2006, 6:14pm UTC](https://www.ruby-forum.com/t/sql-injection/93942/3 "2006-04-15T18:14:54Z")

</div>

On Apr 15, 2006, at 17:57, removed\_email\_address@domain.invalid wrote:

> Hi,  
> All through my current project, I’ve been assuming that rails is  
> clever enough to prevent SQL injections automatically. Is this right?  
> If not, what’s the best way of doing it?

Avoid interpolation of tainted data in SQL fragments:

```
# DON'T DO THIS
user = User.find(:first, :conditions => "id = #{params['id']}")
# DON'T DO THIS

```

Instead, use placeholders:

```
# SAFE
user = User.find(:first, :conditions => ['id = ?', params['id']])

```

or dynamic attribute-based finders (my choice):

```
# SAFE
user = User.find_by_id(params['id'])

```

– fxn

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 15, 2006, 7:32pm UTC](https://www.ruby-forum.com/t/sql-injection/93942/4 "2006-04-15T19:32:06Z")

</div>

On Apr 15, 2006, at 9:12 AM, Xavier N. wrote:

> user = User.find(:first, :conditions =\> “id = #{params[‘id’]}”)  
> user = User.find\_by\_id(params[‘id’])  
> Are you suggesting the standard:

user = User.find(params[‘id’]) isn’t safe?

I’m not 100% certain, but I’m pretty sure you can use the standard  
find to find by id without worrying about SQL injection.

–  
– Tom M.

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 15, 2006, 8:55pm UTC](https://www.ruby-forum.com/t/sql-injection/93942/5 "2006-04-15T20:55:08Z")

</div>

On Apr 15, 2006, at 19:31, Tom M. wrote:

> Are you suggesting the standard:
> 
> user = User.find(params[‘id’]) isn’t safe?
> 
> I’m not 100% certain, but I’m pretty sure you can use the standard  
> find to find by id without worrying about SQL injection.

Oh yes, I wasn’t suggesting that.

I was comparing interpolation versus the other standard idioms, but  
unfortunately I chose an example for which there exists yet a more  
specific idiom (which is safe as well). I’d better used for instance  
“login” instead of “id” in my examples.

– fxn