From: KUBO Takehiro <kubo@...>
Date: 2008-05-30T15:04:12+09:00
Subject: Re: How do i replace actual value in the query with variables?

HI,

On Fri, May 30, 2008 at 9:04 AM, Todd Benson <caduceass@gmail.com> wrote:

> You can expand within double quotes using "#{my_var}", so maybe
> something like...
>
> conn.exec( "UPDATE SCH_EVENT SET P_ID = 2444334 where RANK = #{s} AND
> playlist_id=432")

This is insecure.
  http://en.wikipedia.org/wiki/SQL_injection

Good style is:
  conn.exec( "UPDATE SCH_EVENT SET P_ID = 2444334 where RANK = :1 AND
playlist_id=432", s)

The most efficient way in performance view is:
----------------------------------------------------------------------------------------------------
cursor = conn.parse( 'UPDATE SCH_EVENT SET P_ID = 2444334 where RANK=
:1 AND playlist_id=432')
for q in 0..4
  s = Float(q)
  cursor.exec(s)
end
cursor.close
----------------------------------------------------------------------------------------------------