Are the .order method parameters in ActiveRecord sanitized by default?

Question

I'm trying to pass a string into the .order method, such as

Item.order(orderBy)

I was wondering if orderBy gets sanitized by default and if not, what would be the best way to sanitize it.

Answer 1

The order does not get sanitized. This query will actually drop the Users table:

Post.order("title; drop table users;")

You'll want to check the orderBy variable before running the query if there's any way orderBy could be tainted from user input. Something like this could work:

items = Item.scoped
if Item.column_names.include?(orderBy)
  items = items.order(orderBy)
end