Question

我有以下查询

query = {}
if params[:post_id]  
  query.merge!('post_id' => "profiles.post_id = '#{params[:post_id]}'")
end
if params[:name].present?
  query.merge!('name' => "name = '#{params[:name]}'")
end
if params[:gender].present?
  query.merge!('gender' => "gender = '#{params[:gender}' ")
end

ProductPost.includes(:profiles).where("#{query.values.join(' and ') }").references(:profiles)

如何优化上面的代码以及如何删除我的SQL注入。我在HASH的每个值上都获得了SQL注入。

感谢。

Answer 1

我会写这样的东西：

scope = ProductPost.includes(:profiles).references(:profiles)

scope = scope.where(profiles: { post_id: params[:post_id] }) if params[:post_id]
scope = scope.where(name: params[:name])                     if params[:name]
scope = scope.where(gender: params[:gender])                 if params[:gender]

scope

如何优化查询并删除SQL注入

1 个答案: