Question

I’m doing a query:

    @results = RubyGem.where(
    'name LIKE ?', "%#{searchphrase}%"
    ).paginate(
        :page => params[:page], 
        :per_page => 50, 
        :group => "name", 
        :order => [
            "CASE WHEN name like '#{searchphrase}%' THEN 0 
            WHEN name like '% %#{searchphrase}% %' THEN 1 
            WHEN name like '%#{searchphrase}' THEN 2 
            ELSE 3 END, name"
        ]
    )

But I am pretty sure this is vulnerable to injections… Could someone fix this so it is not, while keeping the functionality the same? I am using Ruby on Rails and MySQL.

Answer 1

@results = RubyGem.where(
    'name LIKE ?', "%#{searchphrase}%"
).paginate(
     :page => params[:page], 
     :per_page => 50, 
     :group => "name", 
     :order => [
       "CASE WHEN name like ? THEN 0 WHEN name like  THEN 1 WHEN name like '%#{searchphrase}' THEN 2 ELSE 3 END, name", "#{searchphrase}%", "% %#{searchphrase}% %"
     ]
)