Comments on: Mongo Beauty #1 http://mepatterson.net/2010/02/mongo-beauty-1/ bestselling author of Devil's Hand, a supernatural thriller; writer of fictions and web software Sun, 29 Jan 2012 11:26:19 +0000 hourly 1 http://wordpress.org/?v=3.3 By: andrew http://mepatterson.net/2010/02/mongo-beauty-1/#comment-265 andrew Sat, 04 Sep 2010 22:48:46 +0000 http://blog.digimonkey.com/?p=64#comment-265 Be sure to sanitize the regular expression, both for accuracy and security. http://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS I'd suggest something like: User.all({ :name => /^#{Regexp.escape(query)}/i }) Be sure to sanitize the regular expression, both for accuracy and security.

http://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS

I’d suggest something like:

User.all({ :name => /^#{Regexp.escape(query)}/i })

]]>