How to avoid SQL injection in Rails 3

Question

In my Controllers I'm using many find_by_sql() stuff, and to avoid SQL injection I'm building my SQL statements as hashes as follows

Beneficiary.find_by_sql(["SELECT * FROM beneficiaries WHERE project_id=? AND cso_id IN(SELECT user_id FROM user_projects INNER JOIN users ON  user_projects.user_id=users.id)",params[:id]])

Is it enough to avoid SQL injection? or need more?

score 2 · Accepted Answer · answered Jun 21 '12 at 05:19

2

Yes, It's enough, you use placeholder for parameters, there is no SQL injection problem.

answered Jun 21 '12 at 05:19

xdazz

158,678
38
247
274

Sorry, actually what you mean by "Place Holder"? can you please elaborate? – Unknown Coder Jun 21 '12 at 06:04
check here, http://en.wikipedia.org/wiki/Prepared_statement, prepared_statement don't have sql injection problem. – xdazz Jun 21 '12 at 06:17

How to avoid SQL injection in Rails 3

1 Answers1