使用rails搜索数组整数列

Question

in my app I have table users that have the following column:

t.integer  "administrations", array: true

and I have code that looks like this:

User.where("administrations::int[] = ARRAY[#{administration_ids.join(',') }]::int[]")

but it is vulnerable for sql injection. I was trying to rewrite those to something like that:

User.where("administrations::int[] = ?", "ARRAY[#{administration_ids.join(',') }]::int[]")

but this not works...

It returns:

PG::InvalidTextRepresentation: ERROR:  array value must start with "{" or dimension information

Answer 1

would

User.where("administrations::int[] = ARRAY[?]::int[]", administration_ids.join(','))

work?

Answer 2

也像这样的工作：

User.where(administrations: '{15,26,62,89,121}')