Create from params and secure searching
Posted on September 5, 2007 - Filed Under RubyOnRails, Security | 2 Comments
I ran on issue. I have users created with User.create(params[:form]) and this is secure, in terms of SQL injection. And how I should find user by email using find with :conditions? Create method does not escape @ sign, but :conditions => ["email = ?", params[:email]]) does escape, so user@domain (inserted to DB by create method) [...]
Popularity: 3% [?]
Read More..>>Exception notification – must have for every Rails application
Posted on September 3, 2007 - Filed Under RubyOnRails, run-n-share | Leave a Comment
In every application I’m using excellent plugin called exception notification. Well, almost in every one, since I had forget to include it in Run-N-Share. When my friend have told me about some error he noticed in RNS I have enlightenment moment, and now RNS works with EN plugin. Exception notification plugin is tool which enables [...]
Popularity: 3% [?]
Read More..>> « go back
