【发布时间】:2013-08-18 16:37:59
【问题描述】:
我在 ruby 2.0.0 @temp = [3, 4] 中有一个数组,我想在 SQL IN 语句中使用它。所以我想删除括号([, ])。
我的 SQL 查询:
SELECT E.id,E.name, CEU.attempt, E.total_mark, CEU.has_attended as attendance, CE.id as categoryexamId, CE.examtype_id as examType, CU.id as categoryuserId, U.name as username
FROM exams E
Inner Join categoryexams CE on E.id = CE.exam_id
Inner Join categoryexamusers CEU on CE.id = CEU.categoryexam_id
Inner Join categoryusers CU on CEU.categoryuser_id = CU.id
Inner Join categories C on CE.category_id = C.id
Inner Join users U on CU.user_id = U.id
Inner Join examtypes ET on CE.examtype_id = ET.id
WHERE CE.category_id = #{category_id} AND CEU.has_attended = 1 AND U.id = #{user} AND CE.currentyear = #{academicYear} AND CE.examtype_id = #{examtype}" + (@temp.blank? ? "" : " AND CEU.categoryexam_id NOT IN (#{@temp})") +
" Group By CE.id;
【问题讨论】:
-
您的代码不安全并且有多个SQL injections!! 另见Rails Guides section on SQL injection
-
我发现将这个查询转换为 Rails 活动记录查询格式非常困难。你能帮忙吗?
标签: sql ruby-on-rails ruby arrays