# Adding the conditions when parameter is available

**URL:** <https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691>\
**Category:** Rails\
**Created:** [March 1, 2009, 1:25am UTC](https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691 "2009-03-01T01:25:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![builtbysimple](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@builtbysimple](https://www.ruby-forum.com/u/builtbysimple)\
**Post date:** [March 1, 2009, 1:25am UTC](https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691/1 "2009-03-01T01:25:46Z")

</div>

Hi all,

How do we add a conditions in a ActiveRecord find method when the  
parameter is available?

Lets say I want to add this category conditions when the parameter  
from the client:  
Product.find(:all, :conditions =\> [“c.id = ?”, params[:catid])

Can we dynamically add that conditions to the find method when it is  
available? Or do I have to manually make an conditional statement when  
the parameter is available then give a different find method?

Thanks in advance.

–  
If you can’t believe in God the chances are your God is too small.

Read my blog: [http://joshuajava.wordpress.com/](http://joshuajava.wordpress.com/)  
Follow me on twitter: [http://twitter.com/jpartogi](http://twitter.com/jpartogi)

---

<div class="post-metadata">

**Author:** ![builtbysimple](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@builtbysimple](https://www.ruby-forum.com/u/builtbysimple)\
**Post date:** [March 1, 2009, 2:36am UTC](https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691/2 "2009-03-01T02:36:31Z")

</div>

I often do the brute-force approach:

cond\_string = []  
cont\_hash = {}

if params[:search\_name]  
cond\_string \<\< “(name ILIKE :name)”  
cond\_hash[:name] = “%#{params[:search\_name]}%”  
end  
if params[:search\_address]  
cond\_string \<\< “(address ILIKE :name)”  
cond\_hash[:address] = “%#{params[:search\_address]}%”  
end

conditions = cond\_string.join(" AND ")  
Person.all :conditions =\> [conditions, cond\_hash]

–Michael

---

<div class="post-metadata">

**Author:** ![builtbysimple](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@builtbysimple](https://www.ruby-forum.com/u/builtbysimple)\
**Post date:** [March 1, 2009, 3:54am UTC](https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691/3 "2009-03-01T03:54:09Z")

</div>

On Mar 1, 1:35 am, Michael G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ```
> cond_string << "(address ILIKE :name)"
> cond_hash[:address] = "%#{params[:search_address]}%"
> 
> ```
> 
> end
> 
> conditions = cond\_string.join(" AND ")  
> Person.all :conditions =\> [conditions, cond\_hash]

The merge\_conditions method (which was protected in previous versions  
of rails) and the scoped named\_scope are also handy for this sort of  
thing.

Fred.

---

<div class="post-metadata">

**Author:** ![builtbysimple](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@builtbysimple](https://www.ruby-forum.com/u/builtbysimple)\
**Post date:** [March 1, 2009, 4:28am UTC](https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691/4 "2009-03-01T04:28:38Z")

</div>

Wow this is a very clean approach. Trying this one out. 🙂

Thanks heaps.

---

<div class="post-metadata">

**Author:** ![builtbysimple](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@builtbysimple](https://www.ruby-forum.com/u/builtbysimple)\
**Post date:** [March 1, 2009, 4:45am UTC](https://www.ruby-forum.com/t/adding-the-conditions-when-parameter-is-available/161691/5 "2009-03-01T04:45:02Z")

</div>

Joshua P. wrote:

> Wow this is a very clean approach. Trying this one out. 🙂

> > cond\_string = []  
> > cont\_hash = {}
> > 
> > if params[:search\_name]  
> > cond\_string \<\< “(name ILIKE :name)”  
> > cond\_hash[:name] = “%#{params[:search\_name]}%”  
> > end

It also prevents SQL injection attacks:

[http://imgs.xkcd.com/comics/exploits\_of\_a\_mom.png](http://imgs.xkcd.com/comics/exploits_of_a_mom.png)