Baffled by single quote in eval

rubyonrails-talk
1

I am trying to understand how to work with a single quote within an eval such as:

assigned_string = ‘’ name = “Addy’s” eval(“assigned_string=‘#{name}’”)

SyntaxError: (eval):1: syntax error, unexpected tIDENTIFIER, expecting $end assigned_string=‘Addy’s’ ^ Ok, this error makes sense, but when I try to escape the single quote I also get an error:

eval(“assigned_string=‘#{name.gsub(/’/,”'“)}'”)

SyntaxError: (eval):1: syntax error, unexpected tIDENTIFIER, expecting $end assigned_string=‘Addy’s’

However if I want to just remove the single quote I am fine and get no error: eval(“assigned_string=‘#{name.gsub(/’/,”“)}'”)

Is there a different way to do such an eval? In actuality what I am doing with this phrase is to assign hash params to the attributes of a class:

eval(“background_process_status.#{key.to_s}=‘#{value}’”)

2

I am trying to understand how to work with a single quote within an eval such as:

assigned_string = ‘’ name = “Addy’s” eval(“assigned_string=‘#{name}’”)

SyntaxError: (eval):1: syntax error, unexpected tIDENTIFIER, expecting $end

assigned_string=‘Addy’s’ ^ Ok, this error makes sense, but when I try to escape the single quote I also get an error:

eval(“assigned_string=‘#{name.gsub(/’/,”'“)}'”)

SyntaxError: (eval):1: syntax error, unexpected tIDENTIFIER, expecting $end

assigned_string=‘Addy’s’

However if I want to just remove the single quote I am fine and get no error: eval(“assigned_string=‘#{name.gsub(/’/,”“)}'”)

Is there a different way to do such an eval? In actuality what I am doing with this phrase is to assign hash params to the attributes of a class:

eval(“background_process_status.#{key.to_s}=‘#{value}’”)

Does it need to use eval? If not, you can just:

background_process.send(“#{key.to_s}=”, value)

3

try this

eval(“assigned_string=#{name}”),am not sure may be it 'l work

4

I'd *highly* recommend that you not do this. Using send is not only more efficient, it's far safer - for instance, what happens if somebody sends your code a value like

'; `rm -rf *`;'

This will be syntactically valid, and will make quite a mess...

--Matt Jones

5

Is there a different way to do such an eval? In actuality what I am doing

with this phrase is to assign hash params to the attributes of a class:

eval(“background_process_status.#{key.to_s}=‘#{value}’”)

I’d highly recommend that you not do this. Using send is not only

more efficient, it’s far safer - for instance, what happens if

somebody sends your code a value like

‘; rm -rf *;’

This will be syntactically valid, and will make quite a mess…

Thanks all… yeah, I will use send, I forgot about that and you are right, it gets yucky very fast when things like single quotes and who knows what else get added.

Also, on this answer: eval(“assigned_string=#{name}”) , no it does not work, this is what I had originally but if you output the internal string it looks like “assigned_string=david” which of course errors out unless what is in ‘name’ is a non string type.

6

> > Is there a different way to do such an eval? In actuality what I am doing > > with this phrase is to assign hash params to the attributes of a class:

> > eval("background_process_status.#{key.to_s}='#{value}'")

> I'd *highly* recommend that you not do this. Using send is not only > more efficient, it's far safer - for instance, what happens if > somebody sends your code a value like

> '; `rm -rf *`;'

> This will be syntactically valid, and will make quite a mess...

Thanks all... yeah, I will use send, I forgot about that and you are right, it gets yucky very fast when things like single quotes and who knows what else get added.

For what it's worth I suspect that the problem was that you needed to escape the \ in your substitution ( ie "\\'")

Fred

7

Is there a different way to do such an eval? In actuality what I am doing

with this phrase is to assign hash params to the attributes of a class:

eval(“background_process_status.#{key.to_s}=‘#{value}’”)

I’d highly recommend that you not do this. Using send is not only

more efficient, it’s far safer - for instance, what happens if

somebody sends your code a value like

‘; rm -rf *;’

This will be syntactically valid, and will make quite a mess…

Thanks all… yeah, I will use send, I forgot about that and you are right,

it gets yucky very fast when things like single quotes and who knows what

else get added.

For what it’s worth I suspect that the problem was that you needed to

escape the \ in your substitution ( ie “\'”)

I just tried this and thought for sure you were right. But no! So let me step back, really I fail to understand why if I have a param[key] value of “Addy’s” that Ruby can not handle it on its own, and much less escaped by (“'” or “\'”):

account.name = “Addy’s” BackgroundProcessStatus.update(:status => “Processing Account name: #{account.name}”)

class BackgroundProcessStatus < ActiveRecord::Base

def self.update(params) background_process_status = BackgroundProcessStatus.first || BackgroundProcessStatus.new params.keys.each do |key| background_process_status.send(“#{key.to_s}=”, params[key])

end

end end

The delayed_job output is: SyntaxError: (eval):2: syntax error, unexpected tIDENTIFIER, expecting $end …Processing Account name: Addy’s Harbor Dodge’ ^ - 0 failed attempts

I dont know if this has to do with it running as a job but if so in the dark as to why that would be as this seems to be pretty basic Ruby.

8

Is there a different way to do such an eval? In actuality what I am doing

with this phrase is to assign hash params to the attributes of a class:

eval(“background_process_status.#{key.to_s}=‘#{value}’”)

I’d highly recommend that you not do this. Using send is not only

more efficient, it’s far safer - for instance, what happens if

somebody sends your code a value like

‘; rm -rf *;’

This will be syntactically valid, and will make quite a mess…

Thanks all… yeah, I will use send, I forgot about that and you are right,

it gets yucky very fast when things like single quotes and who knows what

else get added.

For what it’s worth I suspect that the problem was that you needed to

escape the \ in your substitution ( ie “\'”)

I just tried this and thought for sure you were right. But no! So let me step back, really I fail to understand why if I have a param[key] value of “Addy’s” that Ruby can not handle it on its own, and much less escaped by (“'” or “\'”):

I found the problem — seems that the delayed_job process must be restarted if code is updated. I had updated the code but the old code was seemingly being executed.

9

Hi David,