ruby-on-rails - MySql Query::当查询被触发时，如何解决数据中的 's 问题

Question

我面临这样的问题，其中数据中存在 s 。搜索时不显示数据。我想消除 SQL 注入(inject)问题代码::

@search_condition = ""
          if !search_text.nil?
            search_field = search_text.split("-")
            @search_condition  =  "( address_books.organization_name like '#{search_text}%' or  address_books.business_name like '#{search_text}%' or address_books.federal_tax_id like '#{search_text}%' or address_books.city like '#{search_text}%' or address_books.zip like '#{search_text}%' ) "  if search_field.length == 1

            if search_text.include? "-"
              if search_field.length <= 1
                @search_condition  = " ( address_books.organization_name like '%" + search_field[0] + "%'  "
                @search_condition  += " or address_books.business_name like '%" + search_field[1] + "%'  "
                @search_condition  += " or address_books.federal_tax_id like '%" + search_field[2] + "%'  "
                @search_condition  += " or address_books.city like '%" + search_field[3] + "%'  "
                @search_condition  += " or address_books.zip like '%" +  search_field[4] + "%' ) "

Answer 1

您需要将所有插入的数据替换为？并保存每个数据来替换这个？在数组中

@search_condition = ""
          if !search_text.nil?
            search_field = search_text.split("-")
            if search_field.length == 1
              @search_condition  =  "( address_books.organization_name like ? or  address_books.business_name like ? or address_books.federal_tax_id like ? or address_books.city like ? or address_books.zip like ? ) "  
              @search_condition_datas = ["#{search_text}%", "#{search_text}%", "#{search_text}%", "#{search_text}%", , "#{search_text}%"]
            if search_text.include? "-"
              if search_field.length <= 1
                @search_condition  = " ( address_books.organization_name like ? "
                @search_condition  += " or address_books.business_name like ?"
                @search_condition  += " or address_books.federal_tax_id like ?"
                @search_condition  += " or address_books.city like ?"
                @search_condition  += " or address_books.zip like ?"
                @search_condition_datas = ["%#{search_text[0]}%", "%#{search_text[1]}%", "%#{search_text[2]}%", "%#{search_text[3]}%", , "%#{search_text[4]}%"]

然后您就可以搜索了

User.find(:all, :conditions => [@search_condition] | @search_conditions_datas)

此代码可以在之后重构。实在是太丑了。