如何在ruby中将单引号替换为反斜杠？

Question

In order to prevent sql injection, I did this:

string = "105;' DROP TABLE Suppliers"
new_string = string.gsub("'", %q(\'))
p new_string
=> "105; DROP TABLE Suppliers DROP TABLE Suppliers"

Here why output DROP TABLE Suppliers twice?

Answer 1

Ruby is interpreting the \\' as a backreference to the post-match string($'). So, you are replacing the quote with everything after the quote:

<space>DROP TABLE Suppliers
     V
"105;' DROP TABLE Suppliers"

Here it is with a backreference to the pre-match variable($`):

string = "105;' DROP TABLE Suppliers"
new_string = string.gsub("'", %q(\`))
p new_string

--output:--
"105;105; DROP TABLE Suppliers"

I can't find any documentation for backreferences to ruby's global variables, so congratulations you are a ruby pioneer.

Answer 2

The good news is it turns out you don't have to do that. For more in depth info read the comments bellow. To escape a single quote, you add another single quote. So the winner is:

string.gsub(/'/, "''")