From: Robert Klemme <shortcutter@...>
Date: 2010-03-08T02:20:09+09:00
Subject: Re: Escaping strings

On 03/07/2010 09:14 AM, Krishna Rokhale wrote:
> Nvm, got it.
> 
> require 'mysql'
> 
>    sentence = Mysql.escape_string(sentence.to_s)
>     dbh.do("INSERT INTO sentences (id,text)
>     VALUES
>     (#{id}, '" + sentence + "')")
> 
> 
>    :)
> 

I'd rather use prepared statements with bind variables.  This is much 
safer and also you can offload a bit of work from the database.

Kind regards

	robert

-- 
remember.guy do |as, often| as.you_can - without end
http://blog.rubybestpractices.com/