Create from params and secure searching
Posted on September 5, 2007 - Filed Under RubyOnRails, Security
I ran on issue.
I have users created with User.create(params[:form]) and this is secure, in terms of SQL injection. And how I should find user by email using find with :conditions?
Create method does not escape @ sign, but :conditions => ["email = ?", params[:email]]) does escape, so user@domain (inserted to DB by create method) is something different than user%40domain (queried by find with :conditions).
I wonder how properly create :conditions statement. Of course User.find_by_email is secure (escapes ‘) and finds users by email since it does not escape @, but how to create more complicated queries with :conditions and be SQL injection safe?
I’m going to sleep, maybe tomorrow I find out right solution.
Popularity: 3% [?]
Hits for this post: 2433
Similar Posts
- Cookies and port in host’s location
- Understanding what characters are escaped by AR
- Email verification – regexp
- Simple search in Rails applications
- JavaScript templates – Minus Mor plugin
Comments
2 Responses to “Create from params and secure searching”
Leave a Reply
Which datatabase do you use? I use mysql and there is no escaping of \’@\’ character.
I use MySQL too and You are right.
My Rails Rumble participation resulted in no updating blog :)
It was late night when I wrote this entry and did not found a reason. Somewhere on validating email format (if it has proper format) I did CGI::escape on this string. And thus @ become %40….
CGI::escape ‘test@example.com’
=> “test%40example.com”