Question

I had a method with the following line

@noticias = Noticia.where(:tags.all => array).paginate(:page => params[:page])

it happens that brakeman says that it has a possible sql injection.
I tried the following instead:

 array = params[:query].split(' ')
    array.each_with_index  do |query, index|
      array[index] = array[index].gsub(/<\/?[^>]*>/, "").downcase
    end


    array.each do |tag|
      @noticias << Noticia.where(:tags => tag)
    end

but i got something like `undefined << for nil:NilClass
what am i missing?

Answer 1

If you’re using Mongodb, you can sure that your code is SQL Injection free.

Although MongoDB isn’t vulnerable to anything like SQL-injection, it may be worth checking the search string for anything malicious.
mongodb tutorial