Question

I am using Ruby on Rails 3.1.0 and I would like to know what is a common practice to prevent to store “malicious” values in the database.

For example, I have a database table column means to store URLs. A user, passing the validation (just a length check), can submit a URL like http://<script>alert('hello!');</script>. I would like to do not permit to store links like the above… how can I make that?

Answer 1

The proper thing to do is use URI to parse the supposed URL and then check each component:

validate :url_check

def url_check
    u = URI.parse(self.url)
    # check u.scheme, u.userinfo, etc. and  call errors.add(:url, '...')
    # if something is invalid.
rescue URI::InvalidURIError
    errors.add(:url, 'You are being naughty.')
end