rails find_by sql injection

Question

So I know that Rails helps protect against sql injections when used like this:

Object.find(:first, :conditions=>["name=?",name])

However, I can't seem to find if the autogenerated find_by and find_all_by methods protect agains sql injection.

i.e:

Object.find_by_name(name)

So these two calls have the exact same result. My question is even though the second one is more convenient, should I continue to use the first because it provides protection against sql injection, or does the second do that as well?

Sergio Tulentsev · Accepted Answer · 2012-03-16 11:53:06Z

10

Yes, dynamic attribute-based finders (find_by_* family) do protect your app from sql injections.

answered Mar 16, 2012 at 11:53

Sergio Tulentsev

231k43 gold badges381 silver badges373 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

srchulo Over a year ago

so using where is better than using find?

Sergio Tulentsev Over a year ago

I withdrew that point as highly subjective. I just like it more. :)

Collectives™ on Stack Overflow

rails find_by sql injection

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related