[Tho85]

Some details on how this can be exploited:

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-ma...

[tenderlove]

Thanks for reporting this issue to us! :-D

<3<3<3<3

[Tho85]

Was a pleasure!

With love :-) Thomas

[benmmurphy]

nice find. there is sql injection in 2.3.x and it effects all adapters and not just postgresql.

i just tried quoted_id and it works against mysql on 3.2.x as well. quoted_id is defined in abstract/quoting.rb and any adapter that forwards quotes to the superclass will use it.

[Tho85]

You're right! Thanks for the hint, I updated the blog post accordingly.