开发者

RAILS: safe parameterization of user input in Arel

开发者 https://www.devze.com 2023-03-13 22:55 出处:网络
So before anyone beats the hell out of me, I know how to do this when calling Arel methods. What I\'m curious about is if there is a way to simply get that sql injection safe version of the user input

So before anyone beats the hell out of me, I know how to do this when calling Arel methods. What I'm curious about is if there is a way to simply get that sql injection safe version of the user input so I have it in hand and can do w开发者_高级运维hat I want with it.

Ideally I'd be interested in something along the lines of:

safe_input_data = Person.sql_safe params[:user_data_for_arel_manipulation]

I spent some time last night looking for something that would do this but found nothing. I read all the ActiveRecord methods, but there is jack in the way of documentation. Going simply by the method names and the source of those methods I didn't see anything. I'm hoping someone knows of something.


This will give you an sql safe string:

safe_input_data = Person.sanitize(params[:user_data_for_arel_manipulation])

Be aware, it also adds single quotes to your string!

So "my unsafe input" becomes "'my unsafe input'".

0

精彩评论

暂无评论...
验证码 换一张
取 消