From: Robert Klemme <shortcutter@...>
Date: 2008-05-29T20:15:30+09:00
Subject: Re: Strings, postgresql and gsub

2008/5/29 Peņa, Botp <botp@delmonte-phil.com>:
> From: J-H Johansen [mailto:ondemannen@gmail.com]
> # irb(main):034:0> s.gsub(/'/, "\\'")
> # => "blahblahblah"
>
> faq. try the block form for less headache.

... and less performance.  Proper escaping is the way to go.

> irb(main):006:0>  s.gsub(/'/){"\\'"}
> => "blah\\'blah"

But in this case I agree with David: bind variables are much better
(also safe against SQL injection).

Cheers

robert


-- 
use.inject do |as, often| as.you_can - without end