# SQL injectioning **URL:** \ **Category:** Rails\ **Created:** [September 7, 2009, 7:53am UTC](https://www.ruby-forum.com/t/sql-injectioning/175063 "2009-09-07T07:53:28Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 7:53am UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/1 "2009-09-07T07:53:28Z")
Hi All, What is the best way for the sql injectioning. I have problem with field named “name” that if we enter improper value like salil’s system get crashed. it gives error Mysql::Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘s’ and parent\_id= 21) LIMIT 1 at line 1: SELECT \* FROM `categories` WHERE (name=‘salil’s’ and parent\_id= 21) LIMIT 1 how to avoid that i wwant either of this two 1] user cannot create category with special characters like ’ , \< \> 2] if user enter name with special characteres system shouldn’t get crashed for any situation. Thanks & Regards, Salil G. ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 8:15am UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/2 "2009-09-07T08:15:10Z")
Please see documentation for “h” (html escape) and “sanitize” in rails documentation - might be of some help. From Rails 3, I hear, html will be escaped automatically. Also see this: > **[railspikes.com](http://ww38.railspikes.com/2008/1/28/auto-escaping-html-with-rails)** > > Ruby on Rails Thanks, Abhinav – अभिनव [http://twitter.com/abhinav](http://twitter.com/abhinav) On Mon, Sep 7, 2009 at 11:23 AM, Salil G. \< ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 9:06am UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/3 "2009-09-07T09:06:42Z")
I think project was moved to Github: [GitHub - jasherai/xss\_terminate: git svn clone of xss\_terminate for you git-rails-ers out there... unlikely there will be any enhancements by me](http://github.com/jasherai/xss_terminate/tree/master) BTW, I haven’t used it, and project has not been updated for a while, so do check it and test it before using it. Thanks, Abhinav – अभिनव [http://twitter.com/abhinav](http://twitter.com/abhinav) On Mon, Sep 7, 2009 at 12:01 PM, Salil G. \< ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 11:24am UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/4 "2009-09-07T11:24:16Z")
2009/9/7 Salil G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > (name=‘salil’s’ Â and parent\_id= 21) Â LIMIT 1 > What does the code that generated this sql look like? Colin ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 8:31am UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/5 "2009-09-07T08:31:07Z")
Thanks Abhinav for your quick reply. i use following link to install plugin but nothing happens. script/plugin install [http://xssterminate.googlecode.com/svn/trunk/xss\_terminate](http://xssterminate.googlecode.com/svn/trunk/xss_terminate) do you have any other link to install it. Thanks & Regards, Salil G. ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 4:59pm UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/6 "2009-09-07T16:59:42Z")
You’ll want to look up the documentation for :conditions in ActiveRecord::Base. My guess is that the code you’re using inserts parameters directly into a SQL fragment, which is bad bad bad. –Matt J. On Sep 7, 1:53 am, Salil G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 5:12pm UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/7 "2009-09-07T17:12:30Z")
Colin L. wrote: > 2009/9/7 Salil G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > > > (name=‘salil’s’ Â and parent\_id= 21) Â LIMIT 1 > > What does the code that generated this sql look like? > > Colin > Actuallt i used following code in my Model > Category.find(:first, :conditions=\>[“name= #{self.name} and parent\_id= > 21”]) > it gives error Then i change it as follows Category.find(:first, :conditions=\>["name= ? and "+query, self.name]) and it works like a magic. ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 7, 2009, 6:26pm UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/8 "2009-09-07T18:26:20Z")
You could also write it like this: Category.find(:first, :conditions=\> [“name LIKE :name AND parent\_id = :parent\_id”, {:name =\> self.name, :parent\_id =\> self.parent\_id}] That should properly quote the SQL to avoid injections. On Sep 7, 8:12 am, Salil G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![salil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c89c15/32.png) [@salil](https://www.ruby-forum.com/u/salil)\ **Post date:** [September 8, 2009, 9:13pm UTC](https://www.ruby-forum.com/t/sql-injectioning/175063/9 "2009-09-08T21:13:42Z")
Salil G. wrote: > Category.find(:first, :conditions=\>["name= ? and "+query, self.name]) Maybe you typed this wrong, but using the string “name =? and” + query still looks BAD to me. If “query” could possible contain any user input then it is still not sanitized against SQL Injection. When the following form is used: :conditions =\> [“name = ? and parent\_id = ?”, a, b] Rails will sanitize a and b while substituting them for the ? placeholders. Rails also properly sanitizes when using hashes for the :conditions: :conditions =\> { :name =\> a, :parent\_id =\> b } Rule of thumb: Never directly concatenate to a SQL fragment when there is any possibility that user provided input might be involved.