开发者

Insert delayed and prevention of sql injection

开发者 https://www.devze.com 2023-03-16 20:38 出处:网络
Previously I used Model.create() to insert a row, now, I want to use DELAYED option in Mysql. But, if I write

Previously I used

Model.create() 

to insert a row, now, I want to use DELAYED option in Mysql.

But, if I write

ActiveRecord::Base.connection.execute("INSERT DELAYED INTO `TABLE` (`row`)  VALUES (#{params[:id]})")

so I get sql injectio开发者_JAVA百科n. How to prevent it?


Use connection.quote

id = ActiveRecord::Base.connection.quote(params[:id])
ActiveRecord::Base.connection.execute("INSERT DELAYED INTO `TABLE` (`row`)  VALUES (#{id})")
0

精彩评论

暂无评论...
验证码 换一张
取 消

关注公众号