如何避免sql注入？

Question

我做一個查詢：

@results = RubyGem.where(
    'name LIKE ?', "%#{searchphrase}%" 
    ).paginate(
     :page => params[:page], 
     :per_page => 50, 
     :group => "name", 
     :order => [ 
      "CASE WHEN name like '#{searchphrase}%' THEN 0 
      WHEN name like '% %#{searchphrase}% %' THEN 1 
      WHEN name like '%#{searchphrase}' THEN 2 
      ELSE 3 END, name" 
     ] 
    ) 

但我敢肯定，這是容易注射......有人能解決這個問題，所以它不是，同時保持功能一樣嗎？我正在使用Ruby on Rails和MySQL。

Answer 1

@results = RubyGem.where(
    'name LIKE ?', "%#{searchphrase}%" 
).paginate(
    :page => params[:page], 
    :per_page => 50, 
    :group => "name", 
    :order => [ 
     "CASE WHEN name like ? THEN 0 WHEN name like THEN 1 WHEN name like '%#{searchphrase}' THEN 2 ELSE 3 END, name", "#{searchphrase}%", "% %#{searchphrase}% %" 
    ] 
)