Skip to content

Instantly share code, notes, and snippets.

@ferromir

ferromir/gist:3ba599741eb5b2a3cd83

Created March 20, 2015 05:35
Show Gist options
  • Save ferromir/3ba599741eb5b2a3cd83 to your computer and use it in GitHub Desktop.
Save ferromir/3ba599741eb5b2a3cd83 to your computer and use it in GitHub Desktop.
Download ZIP
ACR - Ruby - SQL Injection
Raw
gistfile1.rb
# This bypasses id == 1 condition and deletes all records
params[:id] = "1) OR 1=1--"
User.delete_all("id = #{params[:id]}")
# Produce:
# DELETE FROM "users" WHERE (id = 1) OR 1=1--)
# Bad
Project.where("name = '#{params[:name]}'")
# Good
Project.where("name = ?", params[:name])
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment