# Contoller code mysteries

**URL:** <https://www.ruby-forum.com/t/contoller-code-mysteries/100681>\
**Category:** Rails\
**Created:** [February 3, 2006, 4:54pm UTC](https://www.ruby-forum.com/t/contoller-code-mysteries/100681 "2006-02-03T16:54:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 3, 2006, 4:54pm UTC](https://www.ruby-forum.com/t/contoller-code-mysteries/100681/1 "2006-02-03T16:54:54Z")

</div>

In my controller…this code works

def list2  
first\_name = params[:client][:first\_name]  
@myclients = Client.find(:all, :conditions =\>  
[“first\_name = :first\_name”, {:first\_name =\> first\_name}])  
end

this code doesn’t…

def list2  
first\_name = params[:client][:first\_name]  
if first\_name  
searchstring = ‘[“first\_name = :first\_name”, {:first\_name =\>  
first\_name}]’  
end

```
@myclients = Client.find(:all, :conditions => searchstring)

```

end

it results in error…

RuntimeError: ERROR C42601 Msyntax error at or near  
“[” P30 Fscan.l L573  
Ryyerror: SELECT \* FROM clients WHERE ([“first\_name = :first\_name”,  
{:first\_name =\> first\_name}])

Why or more specifically, how do I accomplish this since I want to test  
each field from the search form for presence of field data and string  
this together for an ‘or’ type search.

Craig

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 3, 2006, 6:40pm UTC](https://www.ruby-forum.com/t/contoller-code-mysteries/100681/2 "2006-02-03T18:40:29Z")

</div>

Try parameterizing your queries. It protects against sql injection  
attacks:

@foo = Client.find(:all, :conditions =\> [‘first\_name = ?’,  
some\_variable])

I think this will serve you better. I’m writing this code out of my  
head, so  
you may need to relook the syntax.

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 3, 2006, 7:53pm UTC](https://www.ruby-forum.com/t/contoller-code-mysteries/100681/3 "2006-02-03T19:53:00Z")

</div>

Hi,

On 03/02/06, Craig W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> end  
> Try this:

def list2  
first\_name = params[:client][:first\_name]  
if first\_name  
conditions = [“first\_name = :first\_name”, {:first\_name =\>  
first\_name}]  
end

@myclients = Client.find(:all, :conditions =\> conditions)  
end

There is no magical evaluation of string into array. If it expects an  
array you have to give it an array. A string with ruby syntax  
describing an array won’t do.

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [February 4, 2006, 12:34am UTC](https://www.ruby-forum.com/t/contoller-code-mysteries/100681/4 "2006-02-04T00:34:46Z")

</div>

On Fri, 2006-02-03 at 19:50 +0100, Łukasz Piestrzeniewicz wrote:

> > ```
> > end
> > 
> > ```
> 
> first\_name}]  
> end
> 
> @myclients = Client.find(:all, :conditions =\> conditions)  
> end
> 
> There is no magical evaluation of string into array. If it expects an  
> array you have to give it an array. A string with ruby syntax  
> describing an array won’t do.

* * *

I see…said the blind man.

Thanks Lukasz, Steve, Andrej…that makes perfect sense to me now…I of  
course simply see the same language…rails sees the objects.

Craig