ActiveRecord complex， where 子句没有 sql 注入

Question

我正在为我的网站构建搜索，我正在尝试通过将搜索查询拆分为术语来使用搜索查询，然后按子类别或short_description进行搜索：

whereQuery = ''
declared(params).search.downcase.split(' ').each_with_index do |searchTerm, index|
if index != 0
whereQuery += ' and ';
end
whereQuery += '(lower(short_description) like "%'+searchTerm+'%" or lower(subcategory) like "%'+searchTerm+'%")'
end
orders.where(whereQuery).order(number_of_purchases: :desc, rating: :desc)

有没有更好/更安全的方法来避免使用此查询进行 SQL 注入？

Answer 1

使用 ActiveRecord 链接：

orders = Order
declared(params).search.downcase.split(' ').each do |searchTerm|
orders = orders.where('(LOWER(short_description) LIKE ? OR LOWER(subcategory) LIKE ?', "%#{searchTerm}%", "%#{searchTerm}%")
end
orders = orders.order(number_of_purchases: :desc, rating: :desc)