Rails sql injection in custom "where" clause

Question

I'm building a custom where clause for a model, and I wanted to know if the way I'm doing it is a secure way against sql injection attacks. This is my method:

def self.search(search)
  if search
    conditions = []
    conditions << [ 'name like ?', search[:name] ] unless search[:name].blank?
    conditions << [ 'product_type_id = ?', search[:product_type_id] ] unless search[:product_type_id].blank?

    conditions = ( conditions.empty? ? nil : [conditions.transpose.first.join(' and '), *conditions.transpose.last] )
    where(conditions)
  else
    scoped
  end
end

What do yo think? Thanks in advance!

Salil · Accepted Answer · 2012-10-19 08:47:00Z

1

Yes. This is secure way against sql injection attacks.

Following is the example where it is not safe

conditions << [ "name like  #{search[:name]}" ]

answered Oct 19, 2012 at 8:47

Salil

47.7k22 gold badges127 silver badges161 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Rails sql injection in custom "where" clause

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related