Sanitizing data at active record

Question

I want to sanitize the data coming from my form in ActiveRecord. Especially the apostrophe before its actually included into the SQL query. I want it to be something raghu'\s if raghu's is been inputed. I have already tried using:

• sanitize_sql_array
• sanitize_sql_for_assignment
• sanitize_sql_for_conditions
• sanitize_sql_hash_for_assignment
• sanitize_sql_hash_for_conditions

But none of these seem to escape the apostrophe there by failing my SQL query.

Answer 1

Rails will handle a lot of the santizing for you if you use the following format for performing finds. It'll run the necessary sub methods to ensure that nothing potentially destructive is inserted into the database. Not sure about the single inverted comma, but it's worth a shot.

Model.find(:all, :condition => ["text_value = ?", params[:form_input])

Answer 2

You might want to have a look at this thread - Strip & Sanitize BEFORE saving data from the Ruby Forum - I haven't tried any of the solutions mentioned but it might get you going in the right direction