# find\_by\_sql and passing parameter value

**URL:** <https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005>\
**Category:** rubyonrails-talk\
**Created:** [May 6, 2008, 12:38pm UTC](https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005 "2008-05-06T12:38:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![KTU](https://avatars.discourse-cdn.com/v4/letter/k/ecae2f/32.png) [@KTU](https://discuss.rubyonrails.org/u/KTU)\
**Post date:** [May 6, 2008, 12:38pm UTC](https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005/1 "2008-05-06T12:38:03Z")

</div>

Any idea why I cant pass parameter value for the find\_by\_sql query ? simple example below wont work:

loginid = "demo"

sql = 'SELECT \* FROM users where ownerid = "loginid"'

@imitems = Imitem.find\_by\_sql(sql);

but if I change query to this it works:

sql = 'SELECT \* FROM users where ownerid = "demo"'

---

<div class="post-metadata">

**Author:** ![Frederick\_Cheung](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/frederick_cheung/32/3901_2.png) [@Frederick\_Cheung](https://discuss.rubyonrails.org/u/Frederick_Cheung)\
**Post date:** [May 6, 2008, 12:56pm UTC](https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005/2 "2008-05-06T12:56:29Z")

</div>

> Any idea why I cant pass parameter value for the find\_by\_sql query ? simple example below wont work:
> 
> loginid = "demo"
> 
> sql = 'SELECT \* FROM users where ownerid = "loginid"'

Read up on your ruby. How's ruby to know that loginid refers to a  
variable rather than just the string loginid. #{} and connection.quote are your friend. But before you do that, why on earth are you using find\_by\_sql? ImItem.find :all, :conditions =\> {:ownerid =\> loginid} is easier to understand and you have less chance of shooting yourself  
in the foot.

Fred

---

<div class="post-metadata">

**Author:** ![KTU](https://avatars.discourse-cdn.com/v4/letter/k/ecae2f/32.png) [@KTU](https://discuss.rubyonrails.org/u/KTU)\
**Post date:** [May 6, 2008, 1:28pm UTC](https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005/3 "2008-05-06T13:28:14Z")

</div>

Im using it since I have very complex query. I just put here simple example. And yes I tried "#{loginid}" but it wont pass the variable.

---

<div class="post-metadata">

**Author:** ![Frederick\_Cheung](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/frederick_cheung/32/3901_2.png) [@Frederick\_Cheung](https://discuss.rubyonrails.org/u/Frederick_Cheung)\
**Post date:** [May 6, 2008, 1:49pm UTC](https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005/4 "2008-05-06T13:49:54Z")

</div>

> Im using it since I have very complex query. I just put here simple example. And yes I tried "#{loginid}" but it wont pass the variable.

Because your string is using single quotes. Single quotes don't  
interpolate.

Fred

---

<div class="post-metadata">

**Author:** ![Pardee\_Roy](https://avatars.discourse-cdn.com/v4/letter/p/f0a364/32.png) [@Pardee\_Roy](https://discuss.rubyonrails.org/u/Pardee_Roy)\
**Post date:** [May 6, 2008, 3:38pm UTC](https://discuss.rubyonrails.org/t/find-by-sql-and-passing-parameter-value/29005/5 "2008-05-06T15:38:40Z")

</div>

You're not using parameterized SQL. Try:

&nbsp;&nbsp;@imitems = Imitem.find\_by\_sql('select \* from users where ownerid = ?', loginid)

HTH,

-Roy