3 ms·
> „ Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom that protects against SQL injecti
by Lukas_Skywalker 6y ago
> „ Specifically, line 23 strips the code of “reject” and “filter,” which are API functions that implement a programming idiom that protects against SQL injection attacks.“
This is not correct. The mistake was to use ‚find_by_sql‘ without parametrizing the query. The mentioned reject and filter methods are merely skipping some of the data the query returns.
- Delk 6y agoThe previous code that used those functions probably did prevent a SQL injection as a side effect, as using them avoided making a direct SQL query at all. But you're of course correct that it's not the replacement of an ORM call with SQL that's the problem.