使用 AND insted OR Rails 进行 SQL 查询连接答案

【问题标题】：SQL query join with AND insted OR Rails使用 AND insted OR Rails 进行 SQL 查询连接
【发布时间】：2021-12-08 07:27:31
【问题描述】：

这是我的代码

params[:user].keys.each_with_index do |key , index|
            if params[:user].values[index] != ""
                if i == 0
                @users = @event.users.where("networking_content IS NOT NULL AND online_status = ? AND networking_invisible_mode = ? AND users.id != ? ","online",false,current_user.try(:id)).where("#{key} LIKE ?", "%#{params[:user].values[index]}%")
                else
                @users = @users.where("#{key} LIKE ?", "%#{params[:user].values[index]}%")
                end
            end
            i = i+1
        end

这是我得到的查询

> SELECT `users`.* FROM `users` INNER JOIN `event_users` ON `users`.`id` = `event_users`.`user_id` WHERE `event_users`.`event_id` = __ AND (networking_content IS NOT NULL AND online_status = 'online' AND networking_invisible_mode = FALSE AND users.id != ___ ) AND (country_id LIKE '%someplace%') AND (first_name LIKE '%something%') AND (last_name LIKE '%something%') AND (position LIKE '%something%') LIMIT 15 OFFSET 0

我想要 AND 从最后一个替换为 OR ，我想要这样的东西

> SELECT `users`.* FROM `users` INNER JOIN `event_users` ON `users`.`id` = `event_users`.`user_id` WHERE `event_users`.`event_id` = __ AND (networking_content IS NOT NULL AND online_status = 'online' AND networking_invisible_mode = FALSE AND users.id != ___ ) AND (country_id LIKE '%someplace%' OR first_name LIKE '%something%' OR last_name LIKE '%something%' OR position LIKE '%something%') LIMIT 15 OFFSET 0

请帮忙.......

【问题讨论】：

这部分where("#{key} LIKE ?", "%#{params[:user].values[index]}%") 使用从 X 请求接收的参数创建，使您的查询容易受到 SQL 注入，我建议您不要这样做。你能描述一下你想要达到的目标吗？也许还有另一种方法。
@SebastianPalma 我正在尝试制作一个过滤器，其中要过滤的字段及其值分别在 params[:users].kyes 和 params[:users].value 中动态出现。经过多次尝试，我想出了这个来防止sql注入，但仍然没有成功。

标签： mysql sql ruby-on-rails-5 ruby-on-rails-6

【解决方案1】：

我设法想出了一个临时解决方案，

params[:user].keys.each_with_index do |key , index|
            if params[:user].values[index] != ""
                if @users.nil?
                    @users = @event.users.where("networking_content IS NOT NULL AND online_status = ? AND networking_invisible_mode = ? AND users.id != ? ","online",false,current_user.try(:id)).where("#{key} LIKE ?", "%#{params[:user].values[index]}%")
                else
                    @users = @users.or(@event.users.where("networking_content IS NOT NULL AND online_status = ? AND networking_invisible_mode = ? AND users.id != ? ","online",false,current_user.try(:id)).where("#{key} LIKE ?", "%#{params[:user].values[index]}%"))
                end
            end
        end
        @users = @users.page(params[:page]).per(15)

但是还是容易出现sql注入，现在不知道怎么办了。

【讨论】：