Escaping strings

[Krishna Rokhale]

Hi,

This seems rather easy, but its got me stuck.

i am using ruby DBI to insert records into a mysql database.

dbh.do("INSERT INTO sentences (id,text)
VALUES
(#{id},#{sentence})")

the sentence is a pretty long and complex string having many special
characters. I cant seem to escape it out, i tried CGI and the %&&
delimiters, but i cant get it to work.

I appreciate your help!

Thanks!

 

[Krishna Rokhale]

Nvm, got it.

require 'mysql'

sentence = Mysql.escape_string(sentence.to_s)
dbh.do("INSERT INTO sentences (id,text)
VALUES
(#{id}, '" + sentence + "')")

 

[Robert Klemme]

Nvm, got it.

require 'mysql'

sentence = Mysql.escape_string(sentence.to_s)
dbh.do("INSERT INTO sentences (id,text)
VALUES
(#{id}, '" + sentence + "')")

I'd rather use prepared statements with bind variables. This is much
safer and also you can offload a bit of work from the database.

Kind regards

robert

 

[Krishna Rokhale]

I'd rather use prepared statements with bind variables. This is much
safer and also you can offload a bit of work from the database.

Kind regards

robert

Thanks!