我需要一个包含大量字段的搜索表单。 如何在Ruby on Rails中干净地做到这一点？

Question

I'm building a database application that tracks a lot of data for a Person, such as first_name, last_name, DOB, and 20+ more fields.

Users will need to be able to search for all of these fields. I'm having trouble writing clean code for this. The code below is what I have so far in my people_controller:

The data is submitted from a form_tag

def search
    @people = Person.all
    general_info_string = String.new

    if(params[:first_name] != "") then general_info_string << 'people.first_name = "' + params[:first_name] + '" AND ' end
    if(params[:last_name] != "") then general_info_string << "people.last_name = '" + params[:last_name] + "' AND " end
    ... Lots more of similar clauses

    general_info_string = general_info_string[0, general_info_string.length - 5]
         #   ^This line removes the trailing " AND " from the string 
    @people = @people.where(general_info_string)
end

general_info_string is so called because there are more "where" clauses(not shown) and separate strings that I build to search for them.

The problem here is that the code looks like a mess and seems like a "hacky" way to do something that should be well supported by Rails. How could I perform this operation in a cleaner way?

Answer 1

That's not just hacky - it leaves you open to a string injection attack.

You need a :conditions using the ? template, like this example:

:conditions => ["key1 = ?", var]

but you need to make the template part into a string that grows once per parameter, and you need to make the var into an array that grows with each parameter's value. That gives you something like this:

template = []
values = []

if params[:first_name].present?
    template.push 'people.first_name = ?'
    values.push params[:first_name]
end

if params[:last_name].present?
    template.push 'people.last_name = ?'
    values.push params[:last_name]
end

template = template.join(' AND ')
:conditions => [template, *values]

From there, you should DRY up all those ifs, such as with a table of value keys. Then you'd loop through the table, check the key, and push its results into the arrays:

fields = [:first_name, :last_name, :shoe_size, ...]

fields.each do |field|
    if params[field].present?
        template.push "people.#{field} = ?"
        values.push params[field]
    end
end