flawopen.com/SQL Injection in Ruby/ActiveRecord where()

Rails where() with string interpolation: is it safe?

Reference page — draft, pending review
Short answer

No. where("id = #{params[:id]}") is the single most common Rails SQL injection pattern — it compiles and runs exactly like normal ActiveRecord code, which is exactly why it doesn't stand out in review.

UNSAFE
User.where(
  "id = #{params[:id]}"
)
SAFE
User.where(id: params[:id])
# or, for more complex conditions:
User.where("id = ?", params[:id])

Why it's easy to miss

The interpolated version doesn't look like raw SQL — it's still a call to .where(), the same method used everywhere else in the codebase. The danger is entirely inside the string, in the #{} interpolation, which is easy to skim past.

How to check your codebase

grep -rn 'where("' app/ | grep '#{'
Brakeman flags this pattern automatically as "SQL Injection" in its scan output.

FAQ

Is the hash form always available?

Only for simple equality conditions — anything involving operators or ranges needs the ? bound-parameter form instead.

References