Will It Inject? A Look at SQL injections and ActiveRecord

on YouTube ↗33m

" summary

Clear walkthrough of which ActiveRecord calls are safe and which bite back: find and find_by treat inputs as integers or escaped strings, while raw fragments like where(name: user) or group and having can be exploited. Demonstrations show using parameterized queries (the ? placeholder), sanitization via sanitization.rb and quoting.rb, and the game-like testing of examples. Cited breaches (1.2 billion credentials, VTech’s 5M parents / 200k children) underscore why the fixes actually matter.

AI-written summary · about

" chapters (12)

1. 0:00Start
2. 2:32Safety and Security in the em Coffee Shop Line
3. 5:08Google
4. 5:31FIRE 4CID
5. 9:05OWASP Open Web Application Security Project
6. 15:32FLATIRON SCHOOL
7. 16:18SELECT * FROM Restaurant WHERE Type = "bbq"
8. 16:59Will it Inject? A look at SQL injection and active record
9. 19:39type: "burnt ends", dads_rating: 5
10. 20:57Barbecue.where('name = Oklahoma Joes'')
11. 30:46OWASP Ruby on Rails Cheat Sheet your own code
12. 31:32Comp Chomp

" related talks

• 26mWill it inject? A look at SQL injection and ActiveRecordJessica Rudder · RubyConf Colombia 2016
• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 54mTaking on the King: Killing Injection VulnerabilitiesJustin Collins · OWASP AppSec California 2018
• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011
• 24mSQL injection - What is it and how do I prevent it?Justin Swanhart · Percona Live MySQL Conference & Expo 2015
• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 44mEnding Injection VulnerabilitiesCraig Francis · PHP UK Conference 2025