From: Ben Giddings <bg-rubytalk@...>
Date: 2009-09-19T15:35:00+09:00
Subject: Re: Value isn't appended in puts statement(appears on next line)

On Sep 17, 2009, at 17:59, Shot (Piotr Szotkowski) wrote:
> Uh-oh. In this case a good overview and starting point
> might be http://en.wikipedia.org/wiki/SQL_injection

You only really need to worry about SQL injection if you're getting  
the data from an untrusted source.  If you're building a web app and  
are getting data from a text box on a web site, you're at extreme  
risk.  If you're only building a personal tool that won't be deployed  
anywhere interesting, you're only at a mild risk.

Still, it's good practice to never build executable / SQL statements  
by concatenation or interpolation, and instead use placeholders and  
parameter binding, as in the DBI module:

dbh.do("INSERT INTO people (id, name, height) VALUES(?, ?, ?)", nil,  
"Na'il", 76)
Ben