diff options
| author | Xavier Noria <fxn@hashref.com> | 2010-07-09 22:08:24 +0200 |
|---|---|---|
| committer | Xavier Noria <fxn@hashref.com> | 2010-07-09 22:08:24 +0200 |
| commit | 2f04c8785540597b02a265324c91267f09ddd07c (patch) | |
| tree | 0cb9aea2110507b4f525302e1babc998b8cc801e /railties/guides/source/security.textile | |
| parent | c9ae2c11ebbf42d887dced2938a59e8d0634d60a (diff) | |
| parent | c6f4c5916ef467814d970c70627a82c1df4d2686 (diff) | |
| download | rails-2f04c8785540597b02a265324c91267f09ddd07c.tar.gz rails-2f04c8785540597b02a265324c91267f09ddd07c.tar.bz2 rails-2f04c8785540597b02a265324c91267f09ddd07c.zip | |
Merge remote branch 'docrails/master'
Diffstat (limited to 'railties/guides/source/security.textile')
| -rw-r--r-- | railties/guides/source/security.textile | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile index b45514f66d..60108d5ab3 100644 --- a/railties/guides/source/security.textile +++ b/railties/guides/source/security.textile @@ -670,7 +670,7 @@ Also, the second query renames some columns with the AS statement so that the we h5(#sql-injection-countermeasures). Countermeasures -Ruby on Rails has a built in filter for special SQL characters, which will escape ' , " , NULL character and line breaks. <em class="highlight">Using +Model.find(id)+ or +Model.find_by_some thing(something)+ automatically applies this countermeasure</em>. But in SQL fragments, especially <em class="highlight">in conditions fragments (+:conditions => "..."+), the +connection.execute()+ or +Model.find_by_sql()+ methods, it has to be applied manually</em>. +Ruby on Rails has a built-in filter for special SQL characters, which will escape ' , " , NULL character and line breaks. <em class="highlight">Using +Model.find(id)+ or +Model.find_by_some thing(something)+ automatically applies this countermeasure</em>. But in SQL fragments, especially <em class="highlight">in conditions fragments (+:conditions => "..."+), the +connection.execute()+ or +Model.find_by_sql()+ methods, it has to be applied manually</em>. Instead of passing a string to the conditions option, you can pass an array to sanitize tainted strings like this: |