Hello everybody, I would like to ask you if it is safe to use the LIKE clause as follow: Artilce.find(:all, :conditions => ["title LIKE ?", ''%'' + params[:title] +''%'']) Is it safe for sql iyection ? or do I need to escape all characters ??? Thanks in advance -- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en.
Hi, Yes that is safe. Was confused by this myself a couple of days ago. Cheers, Johan On Fri, Nov 27, 2009 at 6:14 PM, Sergio Sergio <sergio.sprite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>wrote:> Hello everybody, I would like to ask you if it is safe to use the LIKE > clause as follow: > > Artilce.find(:all, :conditions => ["title LIKE ?", ''%'' + params[:title] > +''%'']) > > Is it safe for sql iyection ? or do I need to escape all characters ??? > > Thanks in advance > > -- > You received this message because you are subscribed to the Google Groups > "Ruby on Rails: Talk" group. > To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org > To unsubscribe from this group, send email to > rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org<rubyonrails-talk%2Bunsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > . > For more options, visit this group at > http://groups.google.com/group/rubyonrails-talk?hl=en. >-- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en.
ok, thank you 2009/11/27 Johan De Klerk <johandk996-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>> Hi, > > Yes that is safe. Was confused by this myself a couple of days ago. > > Cheers, > Johan > > On Fri, Nov 27, 2009 at 6:14 PM, Sergio Sergio <sergio.sprite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>wrote: > >> Hello everybody, I would like to ask you if it is safe to use the LIKE >> clause as follow: >> >> Artilce.find(:all, :conditions => ["title LIKE ?", ''%'' + params[:title] >> +''%'']) >> >> Is it safe for sql iyection ? or do I need to escape all characters ??? >> >> Thanks in advance >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Ruby on Rails: Talk" group. >> To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org >> To unsubscribe from this group, send email to >> rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org<rubyonrails-talk%2Bunsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> >> . >> For more options, visit this group at >> http://groups.google.com/group/rubyonrails-talk?hl=en. >> > > -- > You received this message because you are subscribed to the Google Groups > "Ruby on Rails: Talk" group. > To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org > To unsubscribe from this group, send email to > rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org<rubyonrails-talk%2Bunsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > . > For more options, visit this group at > http://groups.google.com/group/rubyonrails-talk?hl=en. >-- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en.