# Params from form & condition in request

**URL:** <https://www.ruby-forum.com/t/params-from-form-condition-in-request/189848>\
**Category:** Rails\
**Created:** [June 8, 2010, 9:09pm UTC](https://www.ruby-forum.com/t/params-from-form-condition-in-request/189848 "2010-06-08T21:09:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![stanislavua](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d07c76/32.png) [@stanislavua](https://www.ruby-forum.com/u/stanislavua)\
**Post date:** [June 8, 2010, 9:09pm UTC](https://www.ruby-forum.com/t/params-from-form-condition-in-request/189848/1 "2010-06-08T21:09:58Z")

</div>

Hi  
I have a form on View and I have to construct condition for query  
depending fields which user filled in form.  
I should write something like:

cond  
if params[par1]  
cond = " par1 = #{par1} "

if params[par2]  
cond += " AND par2 = #{par2} "

etc…

Client.all(:conditions =\> cond)  
…  
…

May be someone know more rational way how to do it in RoR?  
Thanks in advance!

---

<div class="post-metadata">

**Author:** ![stanislavua](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/d07c76/32.png) [@stanislavua](https://www.ruby-forum.com/u/stanislavua)\
**Post date:** [June 8, 2010, 9:18pm UTC](https://www.ruby-forum.com/t/params-from-form-condition-in-request/189848/2 "2010-06-08T21:18:42Z")

</div>

Stanislav O. wrote:

> Hi  
> I have a form on View and I have to construct condition for query  
> depending fields which user filled in form.  
> I should write something like:
> 
> cond  
> if params[par1]  
> cond = " par1 = #{par1} "
> 
> if params[par2]  
> cond += " AND par2 = #{par2} "

NO! NEVER EVER DO THAT! You’re leaving yourself wide open to SQL  
injection.

> etc…
> 
> Client.all(:conditions =\> cond)  
> …  
> …
> 
> May be someone know more rational way how to do it in RoR?  
> Thanks in advance!

Well, conditions can take a hash, so how about

conditions = {}  
[:p1, :p2, :p3].each do |p|  
if params[p]  
conditions[p] = params[p]  
end  
end

Client.all :conditions =\> conditions

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid