using a placeholder with joins

Question

I\'m attempting to avoid any SQL injection vulnerabilities by substituting with my params on a join.

Category.joins(\"LEFT OUTER JOIN incomes ON incomes.cate         


        

Answer 1

Try

Category.joins(:incomes).where(:incomes => { :dept_id => params[:Dept] })

And check out the Rails documentation for joining tables.

Answer 2

One option is to use the sanitize_sql_array method. It is, however, a protected method so on your Category model you could do:

class Category < ActiveRecord::Base
  def self.income_for_dept(dept)
    Category.joins(sanitize_sql_array(["LEFT OUTER JOIN incomes ON incomes.category_id = categories.id AND incomes.dept_id = ?", dept]))
  end
end

Then you would call it like:

Category.income_for_dept(params[:Dept])

Ruby provides some other methods, if need be, to get at that method without making a class method in Category.