MySQL madness and Rails (+possible exploit)

Turns out the matches are determined by the beginning character of the string column. For example, if the user's token is '5feZas0352f', the query

  SELECT * FROM users WHERE reset_token = 5;

The behaviour is documented here:

http://dev.mysql.com/doc/refman/5.6/en/type-conversion.html

> For comparisons of a string column with a number ... there are many different strings that may convert to the value 1, such as '1', ' 1', or '1a'.

Summary of the exploit: If you accept a username from a browser that is (artificially, maliciously) submitted in a typed fashion (as a number or bool), and accept it as such, implicit conversion kicks in.

Both Rails and MySQL perform implicit conversion, so if you sanity check your apps to make sure the string you get from your browser or web service is in fact a string, there is no problem.

Or do you trust your web users?