SQL Injection Vulnerability in Ruby on Rails; affects all versions
I am mostly a Django programmer so excuse my ignorance of rails. How does this keep happening?<p>In Django you would do:<p>Post.objects.get(pk=request.GET['id'])<p>There really is no way to do SQL injection this way.<p>This line in rails looks almost exactly like how you would do it in Django:<p>Post.find_by_id(params[:id])<p>Also this seems really serious. It's not like a edge case where you need to grab a post by id. This is probably a very common use case of that method find_by_id.