Ruby/Rails/PostgreSQL PGError: syntax error at or near

Question

I'm getting the error in the title when trying to select a cookie value from a table in a postgresql database, and I've no idea why. Selecting other fields in this table work fine.

Here's the line where it is breaking:

user=UniqueUser.find(:all, :select => 'DISTINCT visitor_id', :conditions=> "visitor_id=#{visitorid}")

The column is defined as character varying(255)

Here's the error:

187/lib/ruby/gems/1.8/gems/activerecord-2.3.5/lib/active_record/connection_adapt
ers/abstract_adapter.rb:219:in `log': PGError: ERROR:  syntax error at or near "
c5a" (ActiveRecord::StatementInvalid)
LINE 1: ...M "unique_users" WHERE (visitor_id=d5fb0ff2-319e-4c5a-b07c-a...

It seems like Rails should put quotes around the data field in the where clause.

I'm certainly not a Rails expert, so it could be something really simple that I am doing wrong, and appreciate any help.

Answer 1

You aren't escaping your input properly. Try this:

user = UniqueUser.find(:all, :select => 'DISTINCT visitor_id', :conditions=> ['visitor_id = ?', visitorid])