# Ruby + mysql **URL:** \ **Category:** ruby-talk\ **Created:** [21 September 2007 09:17 UTC](https://rubytalk.org/t/ruby-mysql/40809 "2007-09-21T09:17:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Guerra\_Antonio](https://avatars.discourse-cdn.com/v4/letter/g/e5b9ba/32.png) [@Guerra\_Antonio](https://rubytalk.org/u/Guerra_Antonio)\ **Post date:** [21 September 2007 09:17 UTC](https://rubytalk.org/t/ruby-mysql/40809/1 "2007-09-21T09:17:57Z")
Sono nelal melma con MySql Voglio inserire un valore in un campo di una maschera video e voglio cercare se questo valore esiste in una data colonna di una tabella qualsiasi: quindi "SELECT \* FROM tabella WHERE variabile = colonna\_tabella" come faccio a dire a MySql che mi deve cercare il contenuto di "variabile" e non la stringa "variabile" nella colonna specificata? Lo stesso problema si pone per il comando insert: tutti gli esempi che ho trovato riportano: INSERT INTO tabella VALUES ('valore1','valore2', ...) se valore1 e' una variabile con un valore qualsiasi come devo fare per: dire a MySql che "valore1" e' una variabile; di inserire nel campo del database il contenuto di "valore1 e non la stringa "valore1" con Ruby? Grazie e saluti > **路路路** > > -- > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). ---
**Author:** ![Ari\_Brown](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Ari\_Brown](https://rubytalk.org/u/Ari_Brown)\ **Post date:** [21 September 2007 11:21 UTC](https://rubytalk.org/t/ruby-mysql/40809/2 "2007-09-21T11:21:23Z")
Have you tried using ActiveRecord? You can get it by typing gem install activerecord I use it a lot for my database, and it makes my code pretty 馃檪 I recommend it to you if you're doing anything with MySQL. -------------------------------------------------------| ~ Ari crap my sig won't fit > **路路路** > > On Sep 21, 2007, at 5:17 AM, Guerra Antonio wrote: > > > Sono nelal melma con MySql > > Voglio inserire un valore in un campo di una maschera video e voglio > > cercare se questo valore esiste in una data colonna di una tabella > > qualsiasi: quindi > > > > "SELECT \* FROM tabella WHERE variabile = colonna\_tabella" ---
**Author:** ![Sharon\_Rosner](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@Sharon\_Rosner](https://rubytalk.org/u/Sharon_Rosner)\ **Post date:** [21 September 2007 14:25 UTC](https://rubytalk.org/t/ruby-mysql/40809/3 "2007-09-21T14:25:45Z")
> Lo stesso problema si pone per il comando insert: tutti gli esempi che > ho trovato riportano: > > INSERT INTO tabella VALUES ('valore1','valore2', ...) > > se valore1 e' una variabile con un valore qualsiasi come devo fare per: > dire a MySql che "valore1" e' una variabile; > di inserire nel campo del database il contenuto di "valore1 e non la > stringa "valore1" con Ruby? Rough translation to English: How do I insert a value into the table without literalizing it, so the value in the table would be the value of the variable named valore1, instead of 'valore1'. The simple answer to your question is this:   sql = "INSERT INTO tabella VALUES ('#{valore1}', ...)"   dbc.query(sql) You can do the same with select statements:   sql = "SELECT \* FROM tabella WHERE '#{variable}' = colonna\_tabella"   dbc.query(sql) However you'll soon run into SQL injection problems, so this is not really the best way to go about it. May I suggest you use an ORM library like Sequel, and then you can do stuff like:   DB[:tabella].insert(valore1, valore2)   DB[:tabella].filter {:colonna\_tabella == variable} Sequel will take care of proper string literalization and protect you from SQL injection. More info here:   [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/ruby-sequel/) best Sharon ---
**Author:** ![Antonio\_Guerra](https://avatars.discourse-cdn.com/v4/letter/a/3be4f8/32.png) [@Antonio\_Guerra](https://rubytalk.org/u/Antonio_Guerra)\ **Post date:** [21 September 2007 17:39 UTC](https://rubytalk.org/t/ruby-mysql/40809/4 "2007-09-21T17:39:19Z")
Thank you a lot, Sharon!!!!!!!!!!! Do you speak italian? I would have to post this question in the italian forum but a wrong command put it in this international forum. > **路路路** > > -- > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). ---
**Author:** ![Ari\_Brown](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Ari\_Brown](https://rubytalk.org/u/Ari_Brown)\ **Post date:** [22 September 2007 01:19 UTC](https://rubytalk.org/t/ruby-mysql/40809/5 "2007-09-22T01:19:44Z")
Ah. yes.. well.... that certainly makes MY response invalid. ---------------------------------------------------------------| ~Ari "I don't suffer from insanity. I enjoy every minute of it" --1337est man alive > **路路路** > > On Sep 21, 2007, at 10:25 AM, Sharon Rosner wrote: > > > Rough translation to English: How do I insert a value into the table > > without literalizing it, so the value in the table would be the value > > of the variable named valore1, instead of 'valore1'. ---
**Author:** ![Sharon\_Rosner](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@Sharon\_Rosner](https://rubytalk.org/u/Sharon_Rosner)\ **Post date:** [21 September 2007 19:09 UTC](https://rubytalk.org/t/ruby-mysql/40809/6 "2007-09-21T19:09:41Z")
> Thank you a lot, Sharon!!!!!!!!!!! > Do you speak italian? I can read more or less. Glad to have helped. sharon