Advertisement
Guest User

Untitled

a guest
Jun 30th, 2015
208
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.53 KB | None | 0 0
  1. This query works,
  2.  
  3. Model.where("major #{operator} :major OR (major = :major AND minor #{operator} :minor)", :major => major, :minor => minor)
  4.  
  5. but I am worried about sql injection passing an escaped string
  6.  
  7. so I tried this
  8.  
  9. `Model.where("major :operator :major OR (major = :major AND minor :operator :minor)", :major => major, :minor => minor, :operator => :operator)`
  10.  
  11. which will throw an error
  12.  
  13. `ERROR: syntax error at or near "1"
  14. LINE 1: ...o_content_view_versions" WHERE (major '=' 1 OR (majo...
  15. `
  16.  
  17. it has an issue with = or > as a string
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement