# Has\_and\_belongs\_to\_many() with attributes

**URL:** <https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730>\
**Category:** Rails\
**Created:** [December 18, 2006, 4:12pm UTC](https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730 "2006-12-18T16:12:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![damaris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/2bfe46/32.png) [@damaris](https://www.ruby-forum.com/u/damaris)\
**Post date:** [December 18, 2006, 4:12pm UTC](https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730/1 "2006-12-18T16:12:16Z")

</div>

Hi you all,  
I have a “has\_and\_belongs\_to\_many()” declaration between models “Pages”  
and “Properties”. However, this relation has another attribute, called  
“value”.

I want to search the pages that have a specific property, but with an  
specific value.  
To find the pages with the specific property, I have the following  
method in the controller:  
def show\_appears  
property = Property.find\_by\_name(@params[:name])  
@pages\_with\_property = property.pages  
end  
But, how can I get from “@pages\_with\_property” the pages with the exact  
value from “@params[:value]”? I can do it stating the SQL statement as  
it is, but I suppose Rails may have a smarter way to do it ☹

Thanks.

---

<div class="post-metadata">

**Author:** ![damaris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/2bfe46/32.png) [@damaris](https://www.ruby-forum.com/u/damaris)\
**Post date:** [December 18, 2006, 7:18pm UTC](https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730/2 "2006-12-18T19:18:01Z")

</div>

Damaris F. wrote:

> Hi you all,  
> I have a “has\_and\_belongs\_to\_many()” declaration between models “Pages”  
> and “Properties”. However, this relation has another attribute, called  
> “value”.
> 
> I want to search the pages that have a specific property, but with an  
> specific value.  
> To find the pages with the specific property, I have the following  
> method in the controller:  
> def show\_appears  
> property = Property.find\_by\_name(@params[:name])  
> @pages\_with\_property = property.pages  
> end  
> But, how can I get from “@pages\_with\_property” the pages with the exact  
> value from “@params[:value]”? I can do it stating the SQL statement as  
> it is, but I suppose Rails may have a smarter way to do it ☹
> 
> Thanks.

try:  
def show\_appears  
property = Property.find\_by\_name(@params[:name])  
@pages\_with\_property = property.pages.find(:all, :conditions =\> “value  
= #{params[:value]}”)  
end

That isnt the most secure way, but it should give you the Pages with  
properties of params[:name] and value of params[:value]

–jake

---

<div class="post-metadata">

**Author:** ![damaris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/2bfe46/32.png) [@damaris](https://www.ruby-forum.com/u/damaris)\
**Post date:** [December 18, 2006, 10:26pm UTC](https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730/3 "2006-12-18T22:26:34Z")

</div>

See has\_many :through

On 12/18/06, Damaris F. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi you all,  
> I have a “has\_and\_belongs\_to\_many()” declaration between models “Pages”  
> and “Properties”. However, this relation has another attribute, called  
> “value”.

–  
\_Deirdre [http://deirdre.net/](http://deirdre.net/)

---

<div class="post-metadata">

**Author:** ![damaris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/2bfe46/32.png) [@damaris](https://www.ruby-forum.com/u/damaris)\
**Post date:** [December 19, 2006, 1:43pm UTC](https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730/4 "2006-12-19T13:43:10Z")

</div>

Deirdre Saoirse M. wrote:

> See has\_many :through
> 
> On 12/18/06, Damaris F. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > Hi you all,  
> > I have a “has\_and\_belongs\_to\_many()” declaration between models “Pages”  
> > and “Properties”. However, this relation has another attribute, called  
> > “value”.
> 
> –  
> \_Deirdre [http://deirdre.net/](http://deirdre.net/)

Yes, before the first answer I changed the relation to a has\_many  
:thorugh. However, I had the same problem. But Jake’s lines of code  
worked fine 😃

Thanks!

---

<div class="post-metadata">

**Author:** ![damaris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/2bfe46/32.png) [@damaris](https://www.ruby-forum.com/u/damaris)\
**Post date:** [December 20, 2006, 5:55pm UTC](https://www.ruby-forum.com/t/has-and-belongs-to-many-with-attributes/79730/5 "2006-12-20T17:55:36Z")

</div>

On Dec 18, 1:18 pm, Jake V. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> > def show\_appears  
> > @pages\_with\_property = property.pages.find(:all, :conditions =\> “value  
> > = #{params[:value]}”)  
> > end
> 
> That isnt the most secure way, but it should give you the Pages with  
> properties of params[:name] and value of params[:value]

Indeed, vulnerable to SQL injection. Use the interpolated form of the  
conditions options:

property.pages.find(:all, :conditions =\> [“value = ?”, params[:value]  
] )

(Otherwise the right answer though 🙂

> –jake
> 
> –  
> Posted viahttp://www.ruby-forum.com/.  
> –  
> Ryan R.  
> [http://raaum.org](http://raaum.org)  
> [http://rails.raaum.org](http://rails.raaum.org) – Rails docs  
> [http://locomotive.raaum.org](http://locomotive.raaum.org) – Self contained one-click Rails for Mac  
> OS X