Xie Hanjian wrote: >> But why the params and session themselves don't contain the real code - >> 'updated_on DESC'. The View could, for example, show 'date' to the user and >> set >> its value to 'updated_on DESC'. Then all this fun goes away! > > Agree. The only reason may be security - user would know your table > column name 'updated_on' if you use it directly in view.
They also might hack the params and put in a SQL injection attack. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
