Question: I have an XML file with an XSLT stylesheet. Internet Explorer opens and renders the XML file as expected. However, File | Print or File | Print Preview does not show any content. What am I missing?

Thanks.

Answer: 
I don't know about rails, but by doing this `Booking.find(:all, :conditions => [ 'bookings.user_id = #{params[user_id]]}'] )`, you risk that the user give to user\_id the value `1 OR 1=1` and as you can see, it will modify your request.

With more injection you could do something like `1; DROP TABLE BOOKINGS` etc.

Basically injection is just "hijacking" a basic request to add yours.

[Bobby tables](http://xkcd.com/327/)
If your data in properly cleaned and sanatized, a user can try to get their own SQL code to run on the server. for example, let's say you have a query like this:

```
 "SELECT * FROM products WHERE product_type = $type"

```

where type is unchanged user input from a text field. now, if I were to search for this type:

(DELETE FROM products)

You are gonna be in a world of hurt. This is why it's important to make sure all user input in sanatized before running it in the DB.