From: Mrmaster Mrmaster <mrsolarlife@...>
Date: 2009-09-18T06:31:39+09:00
Subject: Re: Value isn't appended in puts statement(appears on next line)

Gary Wright wrote:
> On Sep 17, 2009, at 4:36 PM, Mrmaster Mrmaster wrote:
>>
>> Your right and sorry about that Gary. I misunderstood what you were
>> trying to show me :). I deal with a lot of cases where values have  
>> to be
>> inserted into sql statement and string interpolation is definitely a
>> better and cleaner approach.
> 
> 
> My comment was just about interpolation vs. concatenation in
> general but in the specific case of constructing SQL statements,
> I would be *very* careful with string interpolation.  It is
> quite easy to create an SQL injection vector if you aren't
> careful (e.g. http://xkcd.com/327/).
> 
> Most SQL frameworks provide a mechanism for constructing
> parameterized SQL statements that is almost always better
> than constructing the statements via string interpolation.
> 
> For example in Rails:
> :conditions => ['name = ?', name]
> vs.
> :conditions => "name = '#{name}'"
> 
> Gary Wright

The sql statements that I write are mostly basic. I was not aware of sql 
injection. I've heard the term but haven't done much research into it. 
I'll definitely research more into it. Thanks for the great advice.
-- 
Posted via http://www.ruby-forum.com/.