Forum: Ruby on Rails Re: filtering "tags" via checkboxes - HABTM

Announcement (2017-05-07): is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see and for other Rails- und Ruby-related community platforms.
Don Cento (Guest)
on 2006-02-23 21:53
(Received via mailing list)
Many hanks to Joel and Pat for their insight. My modifed version:


def results
     mood_id = params[:mood_id].join(", ")
     @moods = Mood.find(:all, :conditions => "id in (#{mood_id})")


<% for mood in @moods  %>
	<b><%= %></b>
		<% mood.tracks.each do |track| %>
			<li><%= track.title %></li>

Don C.
Pat M. (Guest)
on 2006-02-23 22:15
(Received via mailing list)
As Ezra pointed out, this leaves you vulnerable to SQL injection
attacks.  You need to use the [] and placeholders, not sure what the
idiom is called :)

      mood_id = params[:mood_id].join(", ")
      @moods = Mood.find(:all, :conditions => ["id in (?)", mood_id])

I've never used his ezwhere plugin, but it might be worth looking into.

This topic is locked and can not be replied to.