Is ActiveRecord's "order" method vulnerable to SQL injection?
ruby-on-rails-4, sql
Solution
Yes, ActiveRecord's “order” method is vulnerable to SQL injection.
No, it is not safe to use interpolated strings when calling `.order`.
The above answers to my question have been confirmed by Aaron Patterson, who pointed me to http://rails-sqli.org/#order . From that page:
Taking advantage of SQL injection in ORDER BY clauses is tricky, but a CASE statement can be used to test other fields, switching the sort column for true or false. While it can take many queries, an attacker can determine the value of the field.
Therefore it's important to manually check anything going to `order` is safe; perhaps by using methods similar to @dmcnally's suggestions.
Thanks all.
Problem
I know it's not safe to use interpolated strings when calling `.where`. e.g. this: `Client.where("orders_count = #{params[:orders]}")` should be rewritten as: `Client.where("orders_count = ?", params[:orders])` Is it safe to use interpolated strings when calling `.order`? If not, how should the following be rewritten? `Client.order("#{some_value_1}, #{some_value_2}")`