Sql injection to create a method in rails controller

Question

As seen from comment_controller.rb:

def create @comment = Comment.new(params[:comment]) @comment.save end 

I assume this SQL injection is unsafe. But what is the right way to do this? .. All the examples on the network deal with finds.

Answer 1

This code safe from SQL injection attacks. Escaping is done using ActiveRecord, so every time you invoke the find , create , new / save model, or any other database interaction method, you're fine. The only exception is if you use raw SQL for one of the parameters, for example:

 Comment.find(:all, :conditions => "user_id = #{params[:user_id]}") 

preferred form:

 Comment.find(:all, :conditions => {:user_id => params[:user_id]}) 

which will be automatically protected from SQL injection.

Answer 2

Please note that your sample code is safe from SQL injection, as Alex explained, but it is not protected from bulk exploits .