RailsConf 2016 - Will It Inject? A Look at SQL injections and ActiveRecord by Jessica Rudder

If you've struggled through writing complex queries in raw SQL, ActiveRecord methods are a helpful breath of fresh air. If you're not careful though, those methods could potentially leave your site open to a nasty SQL Injection attack. We'll take a look at the most common ActiveRecord methods (and some of the lesser known ones!) with one question in mind....will it inject? If it's vulnerable to a SQL injection attack, we'll cover how to structure your query to keep your data secure.

[ColumboJedi]

the music at the start of this video is terrible !

[prozacchiwawa]

It's a bit of a tragedy that after all this time, we're still composing SQL in strings. Every API allows it to be done right, but also still allows it to be done wrong. SQL APIs should and could prevent misuse by disallowing literals in SQL strings, instead requiring all concrete values to be passed in via additional arguments. How can we not have done this yet?

[jaykilleen]

Regretting buying Vtech now... I def will not be registering my products with them.