# XSS and SQL Injection attacks

**URL:** <https://www.ruby-forum.com/t/xss-and-sql-injection-attacks/144731>\
**Category:** Rails\
**Created:** [August 1, 2008, 4:07pm UTC](https://www.ruby-forum.com/t/xss-and-sql-injection-attacks/144731 "2008-08-01T16:07:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [August 1, 2008, 4:07pm UTC](https://www.ruby-forum.com/t/xss-and-sql-injection-attacks/144731/1 "2008-08-01T16:07:54Z")

</div>

I have been notified by my boss that a large company that is using my  
app is going to start and try to hack it for vulnerablilities and while  
I feel that I have things pretty well secure I just wanted to inquire  
about, first, what is meant when rails says the SQL statements are  
‘sanatized’ when you use  
find(:all, :conditions =\> [’…’]), and secondely, can any one point  
me to some good online references that deal with XSS and SQL injection  
attacks. Thanks,

-S

---

<div class="post-metadata">

**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\
**Post date:** [August 1, 2008, 4:16pm UTC](https://www.ruby-forum.com/t/xss-and-sql-injection-attacks/144731/2 "2008-08-01T16:16:00Z")

</div>

On 1 Aug 2008, at 15:07, Shandy N. wrote:

> I have been notified by my boss that a large company that is using my  
> app is going to start and try to hack it for vulnerablilities and  
> while  
> I feel that I have things pretty well secure I just wanted to inquire  
> about, first, what is meant when rails says the SQL statements are  
> ‘sanatized’ when you use  
> find(:all, :conditions =\> [’…’]), and secondely, can any one point

sanitized means that the parameters you plug in are escaped so that  
(for example)

find :all, :conditions =\> [“name=?”, “bob’; delete \* from users”] is  
harmlessly escaped.

You should be safe from sql injection as long as you use :conditions  
like this (or the has form of conditions)

If you do this  
find :all, :conditions =\> “name=’#{params[:name]}’”  
then you’re in trouble.

Fred