From: Giles Bowkett <gilesb@...>
Date: 2006-11-01T08:54:46+09:00
Subject: Re: still more relentless non-repetition

ah yeah, that's a good point, SQL injection attacks.

On 10/31/06, Devin Mullins <twifkak@comcast.net> wrote:
> I'm too lazy ATM to read the whole thing and make a design
> recommendation, but Danger, Will Robinson!
> >      eval("@#{params[:thing_to_search_for]}") =
> > (eval(params[:thing_to_search_for].capitalize)).find_by_contents @term
> Major Ruby-injection problem here. NEVER eval something you get from an
> untrusted user. Use, instead, instance_variable_get and Object.const_get.
>
> Devin
>
>


-- 
Giles Bowkett
http://www.gilesgoatboy.org