66

I have the following in a controller

def update
    @permission = Permission.find_by_user_id(params[:user_id])

But I want it to also find by another param, project_id

How can I do something like this in Rails?

@permission = Permission.find_by_user_id_and_project_id(params[:user_id],params[:user_id])
0

4 Answers 4

92

Rails 4 introduces the find_by method:

Permission.find_by(user_id: params[:user_id], project_id: params[:project_id])
3
  • Is this syntax susceptible to SQL Injection?
    – csi
    Commented Sep 9, 2015 at 17:36
  • 1
    I'd like to know this as well. It's a bit confusing when it is ok to use params[:attribute] and when it's not. Commented Jun 4, 2016 at 21:52
  • 4
    It's not susceptible to injection - the only time you are in danger of SQL injection is when you interpolate a submitted param directly into a string meant to be used in a query - like ModelName.where("attribute = '#{params[:attribute]}'"). There are cases where you need a custom query you can't create with ActiveRecord query builders, but in those cases you can use the following syntax: ModelName.where("attribute = ?", params[:attribute]) Commented Jun 5, 2016 at 22:55
67

Yes, you can do finds in a bunch of ways.

Your example below works:

@permission = Permission.find_by_user_id_and_project_id(params[:user_id],params[:project_id])

-- Note your example had two user_ids

In rails 2.x you can also use conditions

@permission = Permission.find(:conditions=>["user_id=? and project_id=?", params[:user_id], params[:project_id]])

And in Rails 3, you can be cool like:

@permission = Permission.where(:user_id=>params[:user_id]).where(:project_id=>params[:project_id]).first
7
  • Thanks, I like the first one though... A lot cleaner. Commented Oct 14, 2010 at 19:25
  • the last one is the rails 3 way... unless put into a scope.
    – DGM
    Commented Oct 14, 2010 at 19:28
  • 1
    Agree with DGM here, scopes are great.... Permission.for(@user).for(@project).first is a good for code readability Commented Oct 15, 2010 at 16:44
  • 1
    @BookOfGreg it's all the same find method. as long as you don't create the SQL strings yourself, it's protected. Don't: "user_id=#{params[:id]}". do: "user_id=?", params[:id] Commented Mar 23, 2012 at 19:11
  • 1
    BTW in rails 4 find_by_user_id_and_project_id is deprecated
    – drhenner
    Commented Mar 6, 2013 at 1:32
4

Try this:

@permission = Permission.find(:conditions => ['user_id = ? and project_id = ?', params[:user_id], params[:project_id]])
4

Rails 3 way with scopes:

scope :by_user_id_and_project_id, lambda {|user_id,project_id| 
    where(:user_id=>user_id).where(:project_id=>project_id])
}

And then you can use it like:

@permission = Permission.by_user_id_and_project_id(params[:user_id],params[:project_id])

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.