Activerecord - RAILS safe parameterization of user input in Arel

Questions

So before anyone beats the hell out of me, I know how to do this when calling Arel methods. What I m curious about is if there is a way to simply get that sql injection safe version of the user input so I have it in hand and can do what I want with it.

Ideally I d be interested in something along the lines of:

safe_input_data = Person.sql_safe params[:user_data_for_arel_manipulation]

I spent some time last night looking for something that would do this but found nothing. I read all the ActiveRecord methods, but there is jack in the way of documentation. Going simply by the method names and the source of those methods I didn t see anything. I m hoping someone knows of something.

Answers

This will give you an sql safe string:

safe_input_data = Person.sanitize(params[:user_data_for_arel_manipulation])

Be aware, it also adds single quotes to your string!

So "my unsafe input" becomes " my unsafe input ".

Source

License : cc by-sa 3.0

http://stackoverflow.com/questions/6410932/rails-safe-parameterization-of-user-input-in-arel

Related