Question

I don’t know how to do the same thing on ruby:

In the php i can use following structure:

while ((list($r_key, $r_value) = each($rule_arr)) 
        && (list($v_key, $v_value) = each($value_arr)) 
        && (list($s_key, $s_value) = each($stack_arr)))
      {
          $insert_rules_for_types = sprintf("INSERT INTO                  
                  `rules_for_types`(`types_id`, `rules_id`, `value`, `stackcount`) 
                   value('%d','%d','%d','%d')", intval($type_id), intval($r_value), 
                   intval($v_value), intval($s_value));

      commit_changes($insert_rules_for_types);
}

How can I do the same on ruby ?

Answer 1

A fairly literal rewriting of it would be something like this:

rule_arr.each do |r_key, r_value|
  value_arr.each do |v_key, v_value|
    stack_arr.each do |s_key, s_value|
      insert_rules_for_types = "INSERT INTO `rules_for_types`(`types_id`,`rules_id`,`value`,`stackcount`) value('%d','%d','%d','%d')" % [
        type_id.to_i,
        r_value.to_i,
        v_value.to_i,
        s_value.to_i
      ]

      commit_changes(insert_rules_for_types)
    end
  end
end

Whatever you’re doing here in PHP, you can probably side-step a lot of the mess of constructing SQL by using an ORM like ActiveRecord which is very broad in scope, or Sequel which is much lighter and more plug-in oriented.

Both of these, when used correctly, will ensure you’ve escaped your SQL properly. Casting to integer is a sign of weak escaping as it’s not a general purpose solution.

Sequel has a Ruby interface to many SQL calls, so an INSERT maps out as some straight-forward code:

db[:rules_for_types].insert(
  :types_id => types_id,
  :rules_id => rules_id,
  :value => v_value,
  :stackcount => s_value
)

Doing it this way makes it very hard to inject unescaped values into your queries.