CODEWITHSUNDEEP
ruby-on-railssecurityactiverecordsql-injection
bigardone
bigardone

Reputation: 174

Rails sql injection in custom "where" clause

I'm building a custom where clause for a model, and I wanted to know if the way I'm doing it is a secure way against sql injection attacks. This is my method:

def self.search(search)
  if search
    conditions = []
    conditions << [ 'name like ?', search[:name] ] unless search[:name].blank?
    conditions << [ 'product_type_id = ?', search[:product_type_id] ] unless search[:product_type_id].blank?

    conditions = ( conditions.empty? ? nil : [conditions.transpose.first.join(' and '), *conditions.transpose.last] )
    where(conditions)
  else
    scoped
  end
end

What do yo think? Thanks in advance!

Upvotes: 0

Views: 434

Answers (1)

Salil
Salil

Reputation: 47482

Yes. This is secure way against sql injection attacks.

Following is the example where it is not safe

conditions << [ "name like  #{search[:name]}" ]

Upvotes: 1

Related Questions