Hot answers tagged rails
Probably not. As you can see, the query uses prepared statements: WHERE `promotions`.`id` = ? Of course, this is only a small part of the query, user input may be inserted directly into the query in other parts of it, so you should check if the id parameter is vulnerable anyways. This may actually be the case, 2170 and 2313 for example do seem to be ...
http://stackoverflow.com/questions/22162350/sql-injection-and-activerecord answers this issue fine. Do not use raw strings in ActiveRecord, use hashes. View http://rails-sqli.org for a complete review of the concerned methods.
Only top voted, non community-wiki answers of a minimum length are eligible