如何防止 SQL 在以下轨道查询中注入？

Question

Data is a param in the below statement:

condition = params["id"].present? ? "employers.status = '#{params["id"].upcase}' and employers.task = '#{data.upcase}'" : "employers.task.rdu = '#{data.upcase}'"

Answer 1

By not using a SQL string in the first place. You can create a WHERE clause by passing a hash instead:

condition = begin do
  if params[:id].present?
    Employer.where(
       status: params[:id].upcase,
       task: data.upcase
    )
  else
    # I have no idea what you're doing with employers.task.rdu
    Employer.where(
      "task.rdu" => data.upcase
    )
  end
end

If you absolutely feel that you need to use a SQL string use placeholders instead of string interpolation:

Employer.where(
  "employers.status = ? and employers.task = ?", params[:id].upcase, data.upcase
)

Employer.where(
  "employers.status = :status and employers.task = :task", 
   status: params[:id].upcase, 
   task: data.upcase
)