# Using Erb inside SQL fiields

**URL:** <https://www.ruby-forum.com/t/using-erb-inside-sql-fiields/131237>\
**Category:** Rails\
**Created:** [March 7, 2008, 5:36am UTC](https://www.ruby-forum.com/t/using-erb-inside-sql-fiields/131237 "2008-03-07T05:36:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ron](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecae2f/32.png) [@ron](https://www.ruby-forum.com/u/ron)\
**Post date:** [March 7, 2008, 5:36am UTC](https://www.ruby-forum.com/t/using-erb-inside-sql-fiields/131237/1 "2008-03-07T05:36:49Z")

</div>

Hi,

So I have a basic CMS I’m working on where a page has a title and a  
body field. The body field is just plain html stored as text in the  
SQL database.

I have two questions/concerns:

1. how do I get erb to work from within the SQL text entry? For  
instance, one of my pages has an image\_tag helper method in it that  
doesn’t work.

2. Is this a secure way to do this? Am I creating a security  
vulnerability by organizing my content this way?

Thanks!

Ron

---

<div class="post-metadata">

**Author:** ![ron](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecae2f/32.png) [@ron](https://www.ruby-forum.com/u/ron)\
**Post date:** [March 7, 2008, 10:31am UTC](https://www.ruby-forum.com/t/using-erb-inside-sql-fiields/131237/2 "2008-03-07T10:31:11Z")

</div>

On 7 Mar 2008, at 04:36, Ron wrote:

> instance, one of my pages has an image\_tag helper method in it that  
> doesn’t work.

You could try messing with render :inline, or I suppose call Erb  
directly

> 1. Is this a secure way to do this? Am I creating a security  
> vulnerability by organizing my content this way?

Well the user could upload \<% system(“rm -rf/”) %\> or \<%  
ActiveRecord::Base.connection.execute(“delete all from foos”)%\> so no,  
not very safe.  
You might be interested in liquid ([http://www.liquidmarkup.org/](http://www.liquidmarkup.org/)) a  
templating language that was designed with that sort of problem in mind.

Fred

---

<div class="post-metadata">

**Author:** ![ron](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecae2f/32.png) [@ron](https://www.ruby-forum.com/u/ron)\
**Post date:** [March 7, 2008, 4:37pm UTC](https://www.ruby-forum.com/t/using-erb-inside-sql-fiields/131237/3 "2008-03-07T16:37:43Z")

</div>

Thanks, Fred. The ability to edit the SQL is behind a hashed login.  
So the set of users looking at this would not type in something like  
that. Although I suppose even leaving that possibility open isn’t a  
good practice.

Liquid markup looks really interesting. I’ll have to try that out.

Ron

On Mar 7, 1:30 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)