插入延迟及防止sql注入

Question

以前我习惯

Model.create() 

插入一行，现在我想在Mysql中使用DELAYED选项。

但是，如果我

ActiveRecord::Base.connection.execute("INSERT DELAYED INTO `TABLE` (`row`)  VALUES (#{params[:id]})")

这样写，我就会得到sql注入。如何预防呢？

Answer 1

使用connection.quote

id = ActiveRecord::Base.connection.quote(params[:id])
ActiveRecord::Base.connection.execute("INSERT DELAYED INTO `TABLE` (`row`)  VALUES (#{id})")