Rails SQL injection?

Question

In Rails, when I want to find by a user given value and avoid SQL injection (escape apostrophes and the like) I can do something like this:

Post.all(:conditi         


        

Answer 1

Yes, it does. Only the second one is dangerous.