-1

What is the difference between "like" and "=" ? For example:

  def sequence
    slug = title.to_param
    sequence = Movie.where("slug = '#{slug}-%'").count + 2
    "#{slug}-#{sequence}"
  end

and 

  def sequence
    slug = title.to_param
    sequence = Movie.where("slug  like #{slug}-%").count + 2
    "#{slug}-#{sequence}"
  end
J.Luca
  • 208
  • 1
  • 10
  • [Take a look](https://stackoverflow.com/questions/1504990/whats-the-difference-between-like-and-in-sql), that's not a question strictly related to Rails. – Sebastián Palma May 16 '20 at 15:07
  • @SebastianPalma several developers said me that using here "like" I can have SQL injections. Is it right? – J.Luca May 16 '20 at 15:17
  • Any query like this one where you interpolate user input directly into a SQL string is vulnerable to a SQL injection attack. But that's really a separate question. – max May 16 '20 at 15:47

1 Answers1

2

"=" will return the exact match "LIKE" will return partial matching

sql injections can happen in both cases You need to do a sanity check on the inputs , use parametrized queries like : User.where("id = ?", params[:user][:user_id]).first

check https://guides.rubyonrails.org/security.html#sql-injection

for "LIKE" operator specifecally a DOS attack could occur check http://rorsecurity.info/portfolio/rails-sql-injection-like

Chanfir
  • 73
  • 2
  • 7