Question

I have a scope for returning a list of projects a user has access too. Either they are on the participant list or they own the project they are listed. Query works fine except its not SQL safe. I can’t figure out how to make the JOIN safe. The where clause is safe but trying the same with join doesn’t work. I can’t seem to find documentation or an answer here. Guessing I’m missing something basic.

scope :manageable_by_user, lambda { |user| 
  joins("LEFT JOIN participants ON 
         participants.project_id = projects.id 
         AND participants.user_id = #{user.id}").
  where("projects.user_id = ? OR projects.user_id IS NOT NULL",user.id)
}

Answer 1

use ActiveRecord::Base.sanitize(string)