控制器#方法中的ActiveRecord :: StatementInvalid

Question

我正在进行复杂的搜索,为此我有特殊的模型:

create_table "cmdb_searches", force: :cascade do |t|
  t.string   "client"
  t.string   "in"
  t.datetime "created_at", null: false
  t.datetime "updated_at", null: false
end

和evms_controller中的方法搜索:

def search
  @cisearch = CmdbSearch.new(search_params)
  @evms = Evm.order('id DESC')
  @evms = @evms.where('client_name=?',@cisearch.client) if #cisearch.client.present?
  @evms = @evms.where('in=?',@cisearch.in) if @cisearch.in.present?
  respond_to do |format|
    format.js
  end
end

并且我的js文件用响应填充了适当的div.如果我将表格留空或仅填写:客户字段,但是如果我填写:它在字段中它将返回错误:

SQLite3::SQLException: near "in": syntax error: SELECT "evms".* FROM "evms" WHERE (in='234543')  ORDER BY id DESC

Answer 1

in是一个SQL运算符.虽然从技术上讲你可以将它用作列名,但为此,你必须将其转义.这就是我试图避免在查询中使用纯SQL的原因.

替换@evms.where('in=?',@cisearch.in)为@evms.where(in: @cisearch.in).这样它将被正确地逃脱.