From: Giles Bowkett <gilesb@...>
Date: 2006-11-01T09:45:43+09:00
Subject: Re: still more relentless non-repetition

> >> Major Ruby-injection problem here. NEVER eval something you get from an
> >> untrusted user. Use, instead, instance_variable_get and Object.const_get.
> >
> > ah yeah, that's a good point, SQL injection attacks.
>
> It's not so much SQL injection as eval injection.  Imagine if
> params[:thing_to_search_for] is "a=1; system('rm -rf /*')" or
> something.  You'd be eval'ing the string:
>
>    @a=1; system('rm -rf /*')

true, that would also be very bad.

-- 
Giles Bowkett
http://www.gilesgoatboy.org