如何防止 SQL 在以下轨道查询中注入？

Question

数据是以下语句中的参数：

condition = params["id"].present? ? "employers.status = '#{params["id"].upcase}' and employers.task = '#{data.upcase}'" : "employers.task.rdu = '#{data.upcase}'"

Answer 1

首先不使用 SQL 字符串。 您可以通过传递 hash 来创建WHERE子句：

condition = begin do
  if params[:id].present?
    Employer.where(
       status: params[:id].upcase,
       task: data.upcase
    )
  else
    # I have no idea what you're doing with employers.task.rdu
    Employer.where(
      "task.rdu" => data.upcase
    )
  end
end

如果您绝对觉得需要使用 SQL 字符串，请使用占位符而不是字符串插值：

Employer.where(
  "employers.status = ? and employers.task = ?", params[:id].upcase, data.upcase
)

Employer.where(
  "employers.status = :status and employers.task = :task", 
   status: params[:id].upcase, 
   task: data.upcase
)