malteseunderdog/fielderic — Issue #23: SQLinjection risk !!!
Author: malteseunderdog
Created: 2012-01-15 13:14:07+00:00
State: open

The controllers should never use the form

Client.first(:conditions => "name LIKE '%#{params[:name]}%'")

as this is dangerous, and opens up to sqlinjection attack. Rather this form should be prefered:

Client.first(:conditions => ["orders_count = ?", params[:orders]])

Please read [here](http://guides.rubyonrails.org/v2.3.11/active_record_querying.html#conditions) for details