CODEWITHSUNDEEP
sqlruby-on-railsrubypostgresql
Mateusz Urbański
Mateusz Urbański

Reputation: 7862

Rails searching through array column and SQL injection

I have quick question. Is this code is vulnerable to SQL injection:

ActiveAdmin::SurveyPack.where("survey_schemas @> '{#{survey_schema}}'")

survey_schemas column is an array column in my rails app.

Upvotes: 0

Views: 113

Answers (2)

Nitin Srivastava
Nitin Srivastava

Reputation: 1424

Please make it simple.

    ActiveAdmin::SurveyPack.where("survey_schemas @> ARRAY[?]", survey_schema)

or

    ActiveAdmin::SurveyPack.where("survey_schemas = ARRAY[?]", survey_schema)

Happy coding.

Upvotes: 2

richfisher
richfisher

Reputation: 951

short answer, yes.

from ActiveAdmin::SurveyPack.where("survey_schemas @> '{#{survey_schema}}'")

to ActiveAdmin::SurveyPack.where("survey_schemas @> '{?}'", survey_schema)

Upvotes: 1

Related Questions