From: Ting Chang <aumart@...>
Date: 2008-05-31T08:04:36+09:00
Subject: Re: How do i replace actual value in the query with variable

Yeah.. this is just a example.....
but #{} does convert the variables into the SQL query,
to_f and to_i works~~

Thanks guys~

-Erick


Florian Gilcher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On May 30, 2008, at 6:37 PM, Phillip Gawlowski wrote:
> 
>>
> Converting to a number type before using the value is injection safe.
> I wonder how
> you are going to convince #to_f  (or #to_i )to return valid SQL code.
> 
> But: why don't you just use prepared Statements?
> 
> Regards,
> Florian Gilcher
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
> 
> iEYEARECAAYFAkhAhKIACgkQJA/zY0IIRZaEsQCeLig1V1IQeJVRcvf2A194pCw7
> vW4AniG9q9dCLwTxChvfAQm9tooTjpqn
> =fp2m
> -----END PGP SIGNATURE-----

-- 
Posted via http://www.ruby-forum.com/.