rails 3 activerecord order - what is the proper sql injection work around?
问题 let us say I have a list page of users and you can sort by the different columns, when clicking 'email' it will pass sort_by=email sort_direction=asc or desc sort_by = "email" # really params[:sort_by] sort_direction = "asc" # really params[:sort_direction] User.order("#{sort_by} #{sort_direction}") # SELECT "users".* FROM "users" ORDER BY email asc so that works as expected, however if we change the sort_by sort_by = "email; DELETE from users; --" User.order("#{sort_by} #{sort_direction}") #