ruby - rails query generates oci:error quoted string incorrectly terminated -

i have following code(very legacy) in application:

  results << user.all(   :select => "'#{entry.name}' user_name, '#{entry.lastname}, #{entry.firstname}' user_full_name, display_name",    :order => "display_name") 

which generates following query following oci error:

  ocierror: ora-01756: quoted string not terminated:  select 'theupsstore2579' user_name, 'o'brien, perry' user_full_name, display_name "users" where.. 

is there way fix query?

is using quote_string way it

yes there way. should not ever use interpolated strings eg "string bit #{interpolated_bit}" in sql query - bad security , leads sql injection attacks.

in case - because 1 of names includes ' character (in last-name o'brien - , once value inserted sql string, treats ' character , ends string - though there more after ' (namely brien bit)

that causes syntax error database.

however - using interpolated strings way leaves open sql injection - if typed in '; drop table users; (or equivalent) last name field? , code happily put sql , ran it? way of using interpolated strings not safe. rails provides alternatives are safe - , should use.

eg built-in arel methods (where select order etc) , use sanitised ? syntax instead of

results << user.all(   :select => "'#{entry.name}' user_name, '#{entry.lastname}, #{entry.firstname}' user_full_name, display_name",    :order => "display_name") 

you try

results << user.select("'?' user_name, '?, ?' user_full_name, display_name", entry.name, entry.lastname, entry.firstname).order("display_name") 

(though question why want force users have same name - did want these conditions selecting users names instead?)

i recommend read through of rails guides. in case 1 on how use active record queries:

and might want read security guide - specifically, in case, rails guide sql injection section