New answers tagged


Probably not. As you can see, the query uses prepared statements: WHERE `promotions`.`id` = ? Of course, this is only a small part of the query, user input may be inserted directly into the query in other parts of it, so you should check if the id parameter is vulnerable anyways. This may actually be the case, 2170 and 2313 for example do seem to be ...

1 answers this issue fine. Do not use raw strings in ActiveRecord, use hashes. View for a complete review of the concerned methods.

Top 50 recent answers are included