Rails, how to sanitize SQL in find_by_sql

ruby-on-rails ruby-on-rails-3 activerecord find-by-sql
nothing-special-here picture nothing-special-here · Aug 22, 2011 · Viewed 17.6k times · Source

Is there a way to sanitize sql in rails method find_by_sql?

I've tried this solution: Ruby on Rails: How to sanitize a string for SQL when not using find?

But it fails at

Model.execute_sql("Update users set active = 0 where id = 2")

It throws an error, but sql code is executed and the user with ID 2 now has a disabled account.

Simple find_by_sql also does not work:

Model.find_by_sql("UPDATE user set active = 0 where id = 1")
# => code executed, user with id 1 have now ban

Edit:

Well my client requested to make that function (select by sql) in admin panel to make some complex query(joins, special conditions etc). So I really want to find_by_sql that.

Second Edit:

I want to achieve that 'evil' SQL code won't be executed.

In admin panel you can type query -> Update users set admin = true where id = 232 and I want to block any UPDATE / DROP / ALTER SQL command. Just want to know, that here you can ONLY execute SELECT.

After some attempts I conclude sanitize_sql_array unfortunatelly don't do that.

Is there a way to do that in Rails??

Sorry for the confusion..

Answer

bor1s picture bor1s · Aug 22, 2011

Try this: 

connect = ActiveRecord::Base.connection();
connect.execute(ActiveRecord::Base.send(:sanitize_sql_array, "your string"))

You can save it in variable and use for your purposes.

Related questions

Check if record exists from controller in Rails

In my app a User can create a Business. When they trigger the index action in my BusinessesController I want to check if a Business is related to the current_user.id: If yes: display the business. If no: redirect …

Read More
Can you do greater than comparison on a date in a Rails 3 search?

I have this search in Rails 3: Note.where(:user_id => current_user.id, :notetype => p[:note_type], :date => p[:date]).order('date ASC, created_at ASC') But I need the :date => p[:date] condition to be …

Read More
How to chain scope queries with OR instead of AND?

I'm using Rails3, ActiveRecord Just wondering how can I chain the scopes with OR statements rather than AND. e.g. Person.where(:name => "John").where(:lastname => "Smith") That normally returns: name = 'John' AND lastname = 'Smith' but I'd like: `…

Read More