SQL injection (ARCH6100)

Key ruby.security.sql-injection · Severity error · Category security · CWE CWE-89

Interpolating or concatenating user input directly into SQL text lets attackers alter the query structure to exfiltrate or modify data.

Incorrect

def search(name)
  User.where("name = '#{name}'").to_a
end

Correct

def search(name)
  User.where("name = ?", name).to_a
end

Fix

Never embed input into SQL; use bound parameters or parameter placeholders.