# 5-second code syntax question

**URL:** <https://www.ruby-forum.com/t/5-second-code-syntax-question/159551>\
**Category:** Rails\
**Created:** [February 5, 2009, 5:22pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551 "2009-02-05T17:22:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 5:22pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/1 "2009-02-05T17:22:15Z")

</div>

Hi there,

I have a n00b question regarding the correct code syntax:

The aim is to have code that looks like this…

==========================  
if @user.low == true  
@low = false  
elsif @user.low == false  
@low = true  
end

# […]

…where every “low” should be replaced by “params[:id]” (in order for  
“low” to be able to take other values, such as “medium” or “high”).

How do I have to write the syntax correctly in my controller?

Thank you very much for your help!  
Tom

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 5:30pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/2 "2009-02-05T17:30:56Z")

</div>

Tom, where is it that you want to replace low with params[:id]?

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 5:38pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/3 "2009-02-05T17:38:40Z")

</div>

Well, basically _everywhere_ where it says “low” in the below code  
example:

# The “resulting” code…

if @user.low == true  
@low = false  
elsif @user.low == false  
@low = true  
end

# […]

…is supposed to be “generated” by something like this… (which is NOT  
yet correct syntax)

==========================  
if @user.{params[:id]} == true  
@{params[:id]} = false  
elsif @user.{params[:id]} == false  
@{params[:id]} = true  
end

# […]

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 6:03pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/4 "2009-02-05T18:03:17Z")

</div>

Be careful here, depending on your user base of course.

What will you do if {params[:id]} (I know, incorrect syntax), evaluates  
to  
“delete!” or something else.

If you have a completely trustworthy user base (such as only you, or  
only  
your colleagues, whom you should trust implicitly, otherwise, why would  
you  
want to work with them), then once you figure out the right syntax  
(which  
probably involves the use of #send, or something like that), you should  
be  
fine.

If you are exposing this to the wild world wide web (WWWW), then I would  
recommend against this.

You would probably be better off writing a helper function that mapped  
params[:id] into one of the acceptable values. Perhaps something like:

def better\_form\_of\_low(user, id)  
case id  
when :low  
user.low

when :high  
user.high  
end

and call that with better\_form\_of\_low(@user, params[:id])

just my $.02 from my paranoid mind 🙂

–wpd

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 6:23pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/5 "2009-02-05T18:23:22Z")

</div>

On Feb 5, 11:11 am, Tom Ha [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Thanks. In this case, the “params[:id]” value is actually a  
> system-generated one - so there’s no user input involved and therefore  
> it should be secure.
> 
> Can you tell my how to get the syntax correct in the above example?
> 
> (“params[:id]” could of course be replaced by any variable, such as  
> “@level”)

Ruby is great for calling methods that you don’t know the name of  
ahead of time. Every object has a “send” method you can call to  
dynamically call methods:

method\_name = params[:id] # or whatever your case may be  
current\_value = @user.send(method\_name) # call the method

Then you can do whatever you want with that value.

Does this help?

Jeff

[purpleworkshops.com](http://purpleworkshops.com)  
[switchingtorails.com](http://switchingtorails.com)

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 6:24pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/6 "2009-02-05T18:24:33Z")

</div>

Patrick is 100% right. And he’s not even being paranoid, it is almost  
guaranteed that someone will try this.

This is how I would do it, and as Patrick suggests, put it in helper:

if (%w(low medium high).include? params[:id]  
instance\_variable\_set("@#{params[:id]}", user.send(params[:id]))  
else

# somebody is being really naughty, blow up their computer

end

You can then get the instance variable by invoking  
instance\_variable\_get("@#{params[:id]}")

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 6:11pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/7 "2009-02-05T18:11:47Z")

</div>

Thanks. In this case, the “params[:id]” value is actually a  
system-generated one - so there’s no user input involved and therefore  
it should be secure.

Can you tell my how to get the syntax correct in the above example?

(“params[:id]” could of course be replaced by any variable, such as  
“@level”)

Thanks!

---

<div class="post-metadata">

**Author:** ![tharrisx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e19adc/32.png) [@tharrisx](https://www.ruby-forum.com/u/tharrisx)\
**Post date:** [February 5, 2009, 6:46pm UTC](https://www.ruby-forum.com/t/5-second-code-syntax-question/159551/8 "2009-02-05T18:46:51Z")

</div>

Responses interwoven below.

Quoting Tom Ha [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> end
> 
> # […]

Breaking your question into pieces.

case @user.low  
when true  
@low = false  
when false  
@low = true  
end

This is exactly equivalent to your code above. If all you care about is  
the  
falseness (nil or false) or trueness (anything else), it can be  
simplified to:

@low = !@user.low

> …is supposed to be “generated” by something like this… (which is NOT  
> yet correct syntax)
> 
> ==========================  
> if @user.{params[:id]} == true  
> @{params[:id]} = false  
> elsif @user.{params[:id]} == false  
> @{params[:id]} = true  
> end

This is harder to handle, your syntax is not valid Ruby, so I have to  
make  
some assumptions what you mean. Again breaking into pieces:

@user.{params[:id]} isn’t valid Ruby.

If @user is a hash, i.e., it was set with something like:

@user = {1 =\> 2, 3 =\> 4}

Then @user[params[:id]] is the proper syntax.

The same is true if @user is derived from ActiveRecord. You will get  
the  
attributes of @user, not the instance variables. Attributes are stored  
in the  
database, instance variables usually aren’t (except of course for the  
values  
in the @attributes hash).

If both @user and the current object instance are ActiveRecords, and  
both are  
only true or false and all values of params[:id] are attribute names:

self[params[:id]] = !@user[params[:id]]

If all values of params[:id] are methods, i.e. explicit via “def abc()  
… end” or implicit (i.e. accessors, e.g. attr\_accessor ‘abc’) then the  
previous example becomes:

self.send(params[:id] + ‘=’, !@user.send(params[:id]])

For most any combination of types, the following is correct:

case @user.send(params[:id])  
when true  
self.send(params[:id] + ‘=’, false)  
when false  
self.send(params[:id] + ‘=’, true)  
end

If “@{params[:id]}” is instance variables without accessors, i.e.  
private,  
someone else will have to answer your question.

HTH,  
Jeffrey