rails refactoring a query for correct sql injection

Question

this is the original query

where(countries.map{|c| "zones.countries LIKE '%#{c}%'"}.join(' OR '))

now i would rewrite this query with ? operator like this

where(countries.map{|c| "zones.countries LIKE ?", "%#{c}%"}.join(' OR '))

but it doesn't work. Any suggestion? thx

Try this previous SO question: http://stackoverflow.com/questions/4430578/how-to-do-a-like-query-in-arel-and-rails-3 — MrDanA, Jul 12 '12 at 13:21
@davide - One performance tip for the query you are writing. 1. Looping on the query is not a good idea 2. Using Like clause with multiple OR's will slow down the query. Try to convert that Like to = and fetch the records. This query wont scale on a large data set. Just throwing out this idea let me know ho it sounds to you. — Raghu, Jul 12 '12 at 13:30

deefour · Accepted Answer · 2012-07-12T13:35:45.997

1

where(countries.map { |c| "zones.countries LIKE ?" }.join(" OR "), *countries.map{ |c| "%#{c}%"})

You can replace the first argument of the where above with something like this to avoid one loop

("zones.countries LIKE ? OR " * countries.size).gsub(/ OR $/, '')

edited Jul 12 '12 at 13:35

answered Jul 12 '12 at 13:24

deefour

1 Answers1