Question

In my controller I have:

if params[:sort].nil?
  @sort = "created_at"
else
  @sort = params[:sort]
end
@konkurrencer = Konkurrencer.where("id NOT IN(?)", @clicked).order("#{@sort} DESC")

I like to add if params[:sort] is different from "created_at", "ratings", or "rating" then it should sort after "created_at".

Answer 1

First, .order("#{@sort} DESC") isn’t a good idea when @sort is taken straight from params. It would be better to use .order('? DESC', @sort).

http://guides.rubyonrails.org/security.html#sql-injection

I’m not sure if I read your question correctly but I’m assuming you want created_at to be the default order with the other valid options being ratings and rating.

@order = case params[:sort]
when 'ratings'
  'ratings DESC'
when 'rating'
  'rating DESC'
else # anything else
  'created_at DESC'
end

@konkurrencer = Konkurrencer.where("id NOT IN(?)", @clicked).order(@order)