3 ms·
That sounds like a recipe for disaster, if that's the only thing you're relying on for input validation of #{id}.
by packetized 9y ago
That sounds like a recipe for disaster, if that's the only thing you're relying on for input validation of #{id}.
- andrewfromx 9y agowhat do you mean. "wefwkefjwe'".to_i will goto zero every time. How is sql injection possible if I to_i your string?
- slantyyz 9y agoWouldn't it be better to not even run the query if id is a non-integer value, or does id = 0 have some intrinsic meaning in your data?