From 02da6dbf8f51dc7e09d86cc7a5f895c1ce41956f Mon Sep 17 00:00:00 2001 From: Donal McBreen Date: Fri, 21 Nov 2025 12:36:45 +0000 Subject: [PATCH] Parameterised queries --- app/models/search/record/sqlite.rb | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/app/models/search/record/sqlite.rb b/app/models/search/record/sqlite.rb index e3ffcf3bf..6c72b3e32 100644 --- a/app/models/search/record/sqlite.rb +++ b/app/models/search/record/sqlite.rb @@ -52,12 +52,18 @@ module Search::Record::SQLite private def upsert_to_fts5_table - self.class.connection.execute( - "INSERT OR REPLACE INTO search_records_fts(rowid, title, content) VALUES (#{id}, #{self.class.connection.quote(title)}, #{self.class.connection.quote(content)})" + self.class.connection.exec_query( + "INSERT OR REPLACE INTO search_records_fts(rowid, title, content) VALUES (?, ?, ?)", + "Search::Record Upsert FTS5", + [id, title, content] ) end def delete_from_fts5_table - self.class.connection.execute("DELETE FROM search_records_fts WHERE rowid = #{id}") + self.class.connection.exec_query( + "DELETE FROM search_records_fts WHERE rowid = ?", + "Search::Record Delete FTS5", + [id] + ) end end