joekur

<div id="admin_menu></div>

<% content_for :body do %>
	<%= yield %>
<% end %>

<%= render :file => 'layouts/application' %>

joekur

STAY SAFE!

SQL Injection

Never interpolate user input directly in a SQL statement.

Don't:

User.where("name = #{params[:search][:name]}")

joekur

# this include won't work for some reason:
# include Capistrano::Git::DefaultStrategy

module SubmoduleStrategy

  # check for a .git directory
  def test
    test! " [ -d #{repo_path}/.git ] "
  end

joekur

Proper use of html_safe

Let's look at an innocuous piece of ruby. Consider some view code showing a user's name and phone number:

"#{first_name} #{last_name} #{phone}"

Great - this is very succinct, readable, and can easily be extracted to a method in a

joekur

# Example usage:
#   timeplot User.all
#   timeplot User.all, bucket_size: day, field: :updated_at
#
# Arguments:
#   bucket_size: One of [:day, :month, :year]. Defaults to :month.
#   field: Timestamp field to plot against. Defaults to :created_at.
class TimePlot
  BUCKET_SIZES = [:day, :month, :year]
  X_AXIS_MAX = 100