4 ms·
I reported this one last year to their security list. I noticed the problem when bots/scrapers screwed with URL parameters which made ActiveRecord generate SQL
by joevandyk 12y ago
I reported this one last year to their security list.
I noticed the problem when bots/scrapers screwed with URL parameters which made ActiveRecord generate SQL for columns and tables that didn't exist in the database. Sorta worrying.
You should make sure that you don't have any columns that match your table names.
- deleted 12y ago[deleted]
- joevandyk 12y agoI was doing Model.find_by_something(params[:value]) if you format params[:value] a certain way, you can get a column other than 'something' selected.