# Can anyone recommend a safe way/strategy to input some search conditions via URL parameters?

**URL:** <https://www.ruby-forum.com/t/can-anyone-recommend-a-safe-way-strategy-to-input-some-search-conditions-via-url-parameters/146437>\
**Category:** Rails\
**Created:** [August 21, 2008, 3:53am UTC](https://www.ruby-forum.com/t/can-anyone-recommend-a-safe-way-strategy-to-input-some-search-conditions-via-url-parameters/146437 "2008-08-21T03:53:34Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![greg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/71c47a/32.png) [@greg](https://www.ruby-forum.com/u/greg)\
**Post date:** [August 21, 2008, 3:53am UTC](https://www.ruby-forum.com/t/can-anyone-recommend-a-safe-way-strategy-to-input-some-search-conditions-via-url-parameters/146437/1 "2008-08-21T03:53:34Z")

</div>

Hi,

Question - Can anyone recommend a safe way/strategy to input some  
search conditions via URL parameters? So the requirements are:

[1] Only use URL parameters (e.g. key & value pair, where value is a  
string)  
[2] At the server side convert these to a query string (i.e. the WHERE  
clause in a SQL select statement)  
[3] Need to “scrub” the inputs to avoid SQL injection  
[4] Want to support more than basic column\_name = value, so I need  
also (here column\_name would be the key):  
(a) column\_name = true/false [for boolean]  
(b) NOT support - i.e. column\_name != value  
(c) IS NOT NULL support, i.e. column\_name IS NOT NULL  
(d) Range, i.e. column\_name IS BETWEEN value1 AND value2  
(e) Some permutations of these, e.g. column name != true (so NOT  
and a boolean)

Any suggestions? Anything I’m missing that solves this in Rails or  
ActiveScaffold?

Background: The background is I’m using the ActiveScaffold (  
[http://activescaffold.com/](http://activescaffold.com/)) out of the box views. It has a server  
side “conditions\_from\_params” that is supported & it passes the URL  
parameters around well (e.g. then sorting buttons at columns continues  
to work even through you’ve filtered down the list of rows). Here’s  
an extract of how I started to add some support to this for “range”  
and “boolean”, however I agree it’s messy. I’m just looking for a  
better way to do the below, plus then add on the other above-mentioned  
support I have. Obviously I could just pass the exact parameters I  
want for the WHERE clause in a query however then I assume there would  
be SQL injection potential issues…

```
# Builds search conditions by search params for column names. This

```

allows urls like “contacts/list?company\_id=5”.  
def conditions\_from\_params  
conditions = nil  
params.reject {|key, value| [:controller, :action,  
:id].include?(key.to\_sym)}.each do |key, value|  
next unless  
active\_scaffold\_config.model.column\_names.include?(key) # reject  
keys that don’t match table column in database

```
    if value.match(".*[.][.].*")
      # Range was specified
      elements = value.split('..')
      conditions = merge_conditions(conditions,

```

[“#{active\_scaffold\_config.model.table\_name}.#{key.to\_s} BETWEEN  
‘#{elements[0]}’ AND ‘#{elements[1]}’ “])  
else  
# No range  
if ( value.upcase == “TRUE” || value.upcase == “FALSE”)  
# Boolean  
conditions = merge\_conditions(conditions,  
[”#{active\_scaffold\_config.model.table\_name}.#{key.to\_s} = ?”,  
value.upcase == “TRUE” ? true : false])  
else  
# Non Boolean  
conditions = merge\_conditions(conditions,  
[“#{active\_scaffold\_config.model.table\_name}.#{key.to\_s} = ?”, value])  
end  
end

```
  end
  conditions
end

```

Thanks