Will it inject? A look at SQL injection and ActiveRecord
summary
Explains how ActiveRecord methods differ in SQL injection risk and gives concrete defenses and examples. Shows that find only accepts integers, find_by escapes hashes, but methods that accept SQL fragments like where, group and having accept raw SQL and can be exploited unless rewritten with parameterized queries using ? placeholders. Notes MySQL and Postgres adapters usually enforce safety, demos building small ORMs to learn pitfalls, and cites massive breaches (Sony ~1M, Russian group ~1.2B, VTech 5M) to show impact.
AI-written summary · about
chapters (5)
related talks
33mWill It Inject? A Look at SQL injections and ActiveRecord
24mSQL injection - What is it and how do I prevent it?
34mThe World of Rails Security
54mTaking on the King: Killing Injection Vulnerabilities
32mSecuring Your Rails App
41mSQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
20mCRUD! The Consequences of Not Understanding How ActiveRecord ...
43mSecuring Your Rails App