how to escape a string before insert or update in Ruby

Posted by ywenbo on Stack Overflow See other posts from Stack Overflow or by ywenbo
Published on 2010-12-24T09:57:45Z Indexed on 2010/12/24 11:53 UTC
Read the original article Hit count: 210

Filed under:

ruby

|

activerecord

|

sql-injection

|

mysql-real-escape-string

Hi guy,

In ruby ActiveRecord doesn't provide dynamic binding for update and insert sqls, of course i can use raw sql, but that need maintain connection, so i want to know if there is simpler way to escape update or insert sql before executing like code below:

ActiveRecord::Base.connection.insert(sql)

i think i can write code by gsub, but i know if there has been a ready method to do it.

thank you very much, and Merry Christmas for you all.

© Stack Overflow or respective owner

Related posts about ruby

Setting up Rails to work with sqlserver

as seen on Stack Overflow - Search for 'Stack Overflow'
Ok I followed the steps for setting up ruby and rails on my Vista machine and I am having a problem connecting to the database. Contents of database.yml development: adapter: sqlserver database: APPS_SETUP Host: WindowsVT06\SQLEXPRESS Username: se Password: paswd Run rake db:migrate… >>> More
marshal data too short!!!

as seen on Stack Overflow - Search for 'Stack Overflow'
My application requires to keep large data objects in session. There are like 3-4 data objects each created by parsing a csv containing 150 X 20 cells having strings of 3-4 characters. My application shows this error- "marshal data too short". I tried this- Deleting the old session table. Deleting… >>> More
Sinatra and XML POST request

as seen on Stack Overflow - Search for 'Stack Overflow'
I don't know is it my mistake or no. So i have that code: <code> post '/singin/get_token' do content_type :xml puts request.body.read puts xmlRequest xmlRequest = REXML::Document.new(request.body.read) ... </code> And when i post something like that: <code> <?xml… >>> More
how to change ruby path from /usr/bin/ruby to /usr/local/bin/ruby

as seen on Stack Overflow - Search for 'Stack Overflow'
reading around the various ruby install tutorials it's required to change path from /usr/bin/ruby to /usr/local/bin/ruby but i cant seem to be able to do it. Ultimately i want to install Ruby 1.9.2, should i uninstall 1.8.7 or what? i tried to install Ruby 1.9.2 with macports, the installation seemed… >>> More
strange bundler error: tar_input.rb:49:in `initialize': not in gzip format (Zlib::GzipFile::Error) o

as seen on Stack Overflow - Search for 'Stack Overflow'
i am getting a strange bundler error when running bundle pack with bundler 0.9.12 any ideas? (see pastie for a better formatted code: http://pastie.org/881328 ) /opt/ruby-enterprise-1.8.7-2010.01/lib/ruby/site_ruby/1.8/rubygems/package/tar_input.rb:49:in `initialize': not in gzip format (Zlib::GzipFile::Error) … >>> More

Related posts about activerecord

Rails & ActiveRecord: Appending methods to models that inherit from ActiveRecord::Base

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a standard ActiveRecord model with the following: class MyModel < ActiveRecord::Base custom_method :first_field, :second_field end At the moment, that custom_method is picked up by a module sent to ActiveRecord::Base. The functionality basically works, but of course, it attaches itself… >>> More
Rails ActiveRecord - Best way to perform an include?

as seen on Stack Overflow - Search for 'Stack Overflow'
I have three models: class Book < ActiveRecord::Base has_many :collections has_many :users, :through => :collections end class User < ActiveRecord::Base has_many :collections has_many :books, :through => :collections end class Collection < ActiveRecord::Base belongs_to… >>> More
Getting types of the attributes in an ActiveRecord object

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to know if it is possible to get the types (as known by AR - eg in the migration script and database) programmatically (I know the data exists in there somewhere). For example, I can deal with all the attribute names: ar.attribute_names.each { |name| puts name } .attributes just… >>> More
Changing ActiveRecord attribute value in before_save hook

as seen on Stack Overflow - Search for 'Stack Overflow'
I needed to fix the encoding of an ActiveRecord attribute and decided to do it in a before_save hook. And at this point I noticed an unexpected feature. When I wanted to change the value of the attribute, simple using the attribute_name=XY did not work as I expected. Instead of that I needed to use… >>> More
Conditions with whitespaces in activerecord find

as seen on Stack Overflow - Search for 'Stack Overflow'
So i am trying to do this Order.find :all, :conditions => "org = 'test org'" what ends up firing is SELECT * FROM `orders` WHERE (org = 'test org') the whitespace in the argument gets stripped. what am i missing.. im really stumped here. please help! >>> More