From: Brian Candler <b.candler@...>
Date: 2011-02-24T18:15:59+09:00
Subject: Re: Using CGI params with a MYSQL query

Doug Al wrote in post #983470:
> The problem I am having is when using #{myparamvariable}, the MYSQL
> query fails it seems because the query is seeing [" "] (brackets) around
> the variable.

That's because params['foo'] is an Array, because CGI allows multiple 
instances of the parameter with the same name, e.g.

    /myprog.cgi?foo=bar&foo=baz

Use:
myparamvariable = params['mycgiparam'][0]
or
myparamvariable = params['mycgiparam'].first

> my query is as follows:
>
> result= dbh.query ("
> SELECT *
> FROM mytable
> WHERE myfield= #{myparamvariable}
> ")

Arghh!! If you do that, you are creating a huge security hole. Google 
for "SQL injection attacks", then see this:
http://xkcd.com/327/

However, ruby-dbi provides you with a simple solution:
http://www.kitebird.com/articles/ruby-dbi.html#TOC_8

dbh.query("SELECT * FROM mytable WHERE myfield=?", myparamvariable)

Always, always, always use this form for constructing queries.

Regards,

Brian.

-- 
Posted via http://www.ruby-forum.com/.