Raw SQL when needed in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is raw SQL in Rails?

Raw SQL means writing plain SQL queries directly instead of using Rails' ActiveRecord methods. It lets you run custom database commands when needed.

beginner

Why might you use raw SQL in a Rails app?

You use raw SQL when ActiveRecord can't express a complex query easily or when you want better performance by writing optimized SQL.

intermediate

How do you safely include user input in raw SQL queries in Rails?

Use parameter binding with question marks or named placeholders to avoid SQL injection. For example: `User.where("name = ?", user_name)`.

intermediate

What method lets you run raw SQL directly in Rails models?

You can use `ActiveRecord::Base.connection.execute(sql)` to run raw SQL commands directly on the database.

beginner

What is a risk of using raw SQL without care?

If you insert user input directly into raw SQL, it can cause SQL injection attacks, which let attackers access or damage your data.

Which Rails method safely inserts user input into raw SQL queries?

A String concatenation with + operator

B Using question marks (?) as placeholders

C Directly inserting variables inside strings

D Using puts to print SQL

Using question marks (?) or named placeholders safely binds parameters and prevents SQL injection.

What does `ActiveRecord::Base.connection.execute(sql)` do?

A Converts SQL to Ruby code

B Creates a new ActiveRecord model

C Validates SQL syntax only

D Runs raw SQL directly on the database

This method runs the given raw SQL string directly on the database.

When should you prefer raw SQL over ActiveRecord methods?

A When queries are too complex or need optimization

B For all simple queries

C To avoid learning ActiveRecord

D When you want to write less code

Raw SQL is best for complex queries or performance tuning not easily done with ActiveRecord.

What is a major security risk of careless raw SQL use?

A Slow app startup

B Syntax errors

C SQL injection attacks

D Memory leaks

Inserting user input directly into SQL can allow attackers to run harmful commands.

Which is NOT a benefit of using raw SQL in Rails?

A Easier to write than ActiveRecord always

B More control over queries

C Better performance in some cases

D Ability to use database-specific features

Raw SQL is not always easier; ActiveRecord is simpler for most common queries.

Explain when and why you would use raw SQL in a Rails application.

Think about complex queries and security.

Describe how to safely include user input in raw SQL queries in Rails.

Focus on security best practices.