Question

I’m trying to sort some records in rails and I’m passing something like created_at DESC as the param, and was wondering — is the SQL properly escaped by ActiveRecord, or is this a bad way of doing it? I tried substituting with ? like I normally do with strings, but though I could get it to work in SQLite, PG threw an error.

Here’s what I’m doing that works — but wondering if it’s safe?

if params[:by]
      @photos = Photo.find(:all, :order => params[:by])      
    else
      ...

Answer 1

If you use the Active Record Query Interface like you did above, Rails will perform the SQL sanitization. See http://guides.rubyonrails.org/active_record_querying.html