Rails SQL injection?

Question

In Rails, when I want to find by a user given value and avoid SQL injection (escape apostrophes and the like) I can do something like this:

Post.all(:conditi         


        

Answer 1

Yes, it does. Only the second one is dangerous.

Answer 2

+1 @fphilipe and @yuval Check this 5 min video from railscast and this one from rails guide

Answer 3

One good reference from the RoR Guides.