From: Nathan Taylor-Hoover <onebitcipher@...>
Date: 2007-06-14T04:53:13+09:00
Subject: Re: Querying MySQL from a select box form

------=_Part_28951_2444689.1181764393702
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On the security side of things you might want to code some input validation
routines.  I can't see all of your code or the back parts of it but it
appears that you might be leaving yourself open to SQL injection attacks.

- Nathan

On 6/12/07, Brandon Robison <robison.brandon@gmail.com> wrote:
>
> I don't even know how to explain the weirdness of this one except to
> show the query it's making when it displays the error
>
> http://www.customlasercutting.com/site/info/materials
>
> Scroll down to the yellow "Materials search too" box and try selecting,
> say... black AND black top white core (under colors). Normally the query
> uses IN, not LIKE, but so I could see the query, I made it like that.
>
> Notice how it puts %2520 for spaces (or %252F for /)? It messes up the
> query, obviously. How would I tell it to output a " " instead of %2520?
>
> Also, it only does it when multiple items are selected. If you select
> JUST one item with spaces, it works
>
> Ruby code: http://pastie.caboo.se/69978
> Select boxes: http://pastie.caboo.se/69979
>
> Any help with this would be greatly appreciated! Thanks in advance.
>
> --
> Posted via http://www.ruby-forum.com/.
>
>

------=_Part_28951_2444689.1181764393702--