From: Mike Fletcher <lemurific+rforum@...>
Date: 2006-11-16T23:50:35+09:00
Subject: Re: parse xml file, put results in mysql db

Jon Egil Strand wrote:
> DBI.connect('DBI:ODBC:database') do |dbh|
>   your_data_structure.each do |data|
>     sql = "INSERT INTO table
>   	    (col1,
>   	     col2,
>              col3)
> 	   VALUES
>             ('#{data.val1}',
>              '#{data.val2}',
>              '#{data.val3}')"
>     dbh.do( sql )
>   end
> end

Pardon me, but your gaping SQL injection hole is showing.

http://joelonsoftware.com/items/2006/11/01.html

-- 
Posted via http://www.ruby-forum.com/.