From: Gary Wright <gwtmp01@...>
Date: 2009-09-18T06:15:01+09:00
Subject: Re: Value isn't appended in puts statement(appears on next line)


On Sep 17, 2009, at 4:36 PM, Mrmaster Mrmaster wrote:
>
> Your right and sorry about that Gary. I misunderstood what you were
> trying to show me :). I deal with a lot of cases where values have  
> to be
> inserted into sql statement and string interpolation is definitely a
> better and cleaner approach.


My comment was just about interpolation vs. concatenation in
general but in the specific case of constructing SQL statements,
I would be *very* careful with string interpolation.  It is
quite easy to create an SQL injection vector if you aren't
careful (e.g. http://xkcd.com/327/).

Most SQL frameworks provide a mechanism for constructing
parameterized SQL statements that is almost always better
than constructing the statements via string interpolation.

For example in Rails:
:conditions => ['name = ?', name]
vs.
:conditions => "name = '#{name}'"

Gary Wright