# Can :conditions use an array and a dictionary together?

**URL:** <https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062>\
**Category:** Rails\
**Created:** [August 20, 2009, 9:09am UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062 "2009-08-20T09:09:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [August 20, 2009, 9:09am UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062/1 "2009-08-20T09:09:11Z")

</div>

This is what I’m trying to do:

@contacts = Contact.find(:all, :conditions =\> [[“jobs.name LIKE ?”,  
‘Teacher%’], {:group\_id =\> current\_contact.group}], :include =\>  
[:jobs, :photos])

Obviously it’s not working. Is this my only option?  
@contacts = Contact.find(:all, :conditions =\> [‘jobs.name LIKE ? AND  
group\_id = ?’, ‘Teacher%’, current\_contact.group], :include =\>  
[:jobs, :photos])

---

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [August 20, 2009, 10:42am UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062/2 "2009-08-20T10:42:52Z")

</div>

Quoting CoolAJ86 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> [:jobs, :photos])  
> :conditions =\>  
> “jobs.name LIKE ‘Teacher%’ AND group\_id = #{current\_contact.group}”

HTH,  
Jeffrey

---

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [August 20, 2009, 10:51am UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062/3 "2009-08-20T10:51:39Z")

</div>

On Aug 20, 8:01 am, CoolAJ86 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> This is what I’m trying to do:
> 
> @contacts = Contact.find(:all, :conditions =\> [[“jobs.name LIKE ?”,  
> ‘Teacher%’], {:group\_id =\> current\_contact.group}], :include =\>  
> [:jobs, :photos])
> 
> Obviously it’s not working. Is this my only option?  
> @contacts = Contact.find(:all, :conditions =\> [‘jobs.name LIKE ? AND  
> group\_id = ?’, ‘Teacher%’, current\_contact.group], :include =\>  
> [:jobs, :photos])

In general that is about it. In this particular case it looks like you  
could do

current\_contact.group.contacts.find :all, :conditions =\> [[“jobs.name  
LIKE ?”, ‘Teacher%’], …

assuming that group has\_many contacts

Fred

---

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [August 20, 2009, 12:28pm UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062/4 "2009-08-20T12:28:06Z")

</div>

Jeffrey L. Taylor wrote:

> Quoting CoolAJ86 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):
> 
> > [:jobs, :photos])  
> > :conditions =\>  
> > “jobs.name LIKE ‘Teacher%’ AND group\_id = #{current\_contact.group}”
> 
> HTH,  
> Jeffrey

Passing a string to :conditions like this welcomes sql injection attacks  
So can it be avoided and pass an array instaed like in last post by  
fred?Am I right?

Sijo

---

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [August 20, 2009, 6:45pm UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062/5 "2009-08-20T18:45:14Z")

</div>

> In general that is about it. In this particular case it looks like you  
> could do
> 
> current\_contact.group.contacts.find :all, :conditions =\> [[“jobs.name  
> LIKE ?”, ‘Teacher%’], …

As I understand it, that won’t eager-load (join) groups, jobs, and  
contacts together.

See, as I iterate through contacts I want to pull group and job  
information without excess database calls.

---

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [August 20, 2009, 6:35pm UTC](https://www.ruby-forum.com/t/can-conditions-use-an-array-and-a-dictionary-together/174062/6 "2009-08-20T18:35:17Z")

</div>

Quoting Sijo Kg [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> Passing a string to :conditions like this welcomes sql injection attacks  
> So can it be avoided and pass an array instaed like in last post by  
> fred?Am I right?

Only if current\_contact.group is string. I assumed that it is an  
integer, in  
which case, no SQL injection attack is possible for this call.

Jeffrey