Preventing SQL Injection attacks in Ruby ActiveRecord
ActiveRecord is prone to SQL Injection attacks and as such should be properly coded in order to prevent these attempts from succeeding. Ruby recommends you to use question mark when passing variables to the SQL database processing routine.
my_record = [“name = ?”, name]
You can also resort to named variable, which is also used to prevent SQL injection attacks in ActiveRecord.
my_record = [“name = :name”, {:name => name}]
Writing proper ActiveRecord code will stop anyone from penetrating your database with statement like “or 1=1” if then try to append it to the end of your SQL string.