相关疑难解决方法(0)

让我们说我有一个用户列表页面,您可以按不同的列排序,点击"电子邮件"时它将通过sort_by = email sort_direction = asc或desc

sort_by = "email" # really params[:sort_by]
sort_direction = "asc" # really params[:sort_direction]
User.order("#{sort_by} #{sort_direction}")
# SELECT "users".* FROM "users" ORDER BY email asc

所以如果我们更改sort_by,那么按预期工作

sort_by = "email; DELETE from users; --"
User.order("#{sort_by} #{sort_direction}")
# SELECT "users".* FROM "users" ORDER BY email; DELETE from users; -- asc

现在我们没有更多用户:(

我可以手动构建一个有效sort_by的白名单,并将params [:sort_by]与之比较,但希望有一些内置的方法来处理这种事情