# Toggleable sorting useing session variable?

**URL:** <https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402>\
**Category:** rubyonrails-talk\
**Created:** [December 3, 2006, 9:36pm UTC](https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402 "2006-12-03T21:36:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnu\_Gopal](https://avatars.discourse-cdn.com/v4/letter/v/b9e5f3/32.png) [@Vishnu\_Gopal](https://discuss.rubyonrails.org/u/Vishnu_Gopal)\
**Post date:** [December 3, 2006, 9:36pm UTC](https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402/1 "2006-12-03T21:36:10Z")

</div>

Yup. SQL injection. params[:sort\_by] could contain an SQL fragment.

Vish

---

<div class="post-metadata">

**Author:** ![Vishnu\_Gopal](https://avatars.discourse-cdn.com/v4/letter/v/b9e5f3/32.png) [@Vishnu\_Gopal](https://discuss.rubyonrails.org/u/Vishnu_Gopal)\
**Post date:** [December 4, 2006, 6:52am UTC](https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402/2 "2006-12-04T06:52:43Z")

</div>

@books = paginate :books, :order =\> [‘?’, sort\_by], :per\_page =\> 10 ?

Vish

---

<div class="post-metadata">

**Author:** ![Vishnu\_Gopal](https://avatars.discourse-cdn.com/v4/letter/v/b9e5f3/32.png) [@Vishnu\_Gopal](https://discuss.rubyonrails.org/u/Vishnu_Gopal)\
**Post date:** [December 4, 2006, 9:48am UTC](https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402/3 "2006-12-04T09:48:48Z")

</div>

Hmm weird. Try a space after the ?, as in "? ".

Vish

---

<div class="post-metadata">

**Author:** ![Vishnu\_Gopal](https://avatars.discourse-cdn.com/v4/letter/v/b9e5f3/32.png) [@Vishnu\_Gopal](https://discuss.rubyonrails.org/u/Vishnu_Gopal)\
**Post date:** [December 4, 2006, 2:01pm UTC](https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402/4 "2006-12-04T14:01:06Z")

</div>

What about “? DESC” or “? ASC” ? Trial and error (and script/console) is a good friend 🙂 Sadly I don’t have irb right now.

Vish

---

<div class="post-metadata">

**Author:** ![olbrich](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/olbrich/32/10820_2.png) [@olbrich](https://discuss.rubyonrails.org/u/olbrich)\
**Post date:** [December 4, 2006, 7:31pm UTC](https://discuss.rubyonrails.org/t/toggleable-sorting-useing-session-variable/5402/5 "2006-12-04T19:31:03Z")

</div>

Vishnu Gopal wrote:

> What about "? DESC" or "? ASC" ? Trial and error (and script/console) is a good friend 🙂 Sadly I don't have irb right now.
> 
> Vish
> 
> \> \> \> \>Vishnu Gopal wrote: \> \> Hmm weird. Try a space after the ?, as in "? ". \> \> That returns the same error: \> \> \> SELECT \* FROM books ORDER BY ? isbn LIMIT 0, 10 \> \> I can't believe this paginate issue hasn't been covered somewhere! My \> searches only revealed that one thread posted above. \> \> -- \> Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). \> \> \> \>
> 
> ------=\_Part\_45211\_14470071.1165240866527 Content-Type: text/html; charset=ISO-8859-1 X-Google-AttachSize: 982
> 
> What about &quot;? DESC&quot; or &quot;? ASC&quot; ? Trial and error (and script/console) is a good friend 🙂 Sadly I don't have irb right now.\<br\>\<br\>Vish\<br\>\<br\>\<div\>\<span class="gmail\_quote"\>On 12/4/06, \<b class="gmail\_sendername"\> Taylor Strait\</b\> &lt;\<a href="mailto:rails-mailing-list@andreas-s.net"\>rails-mailing-list@andreas-s.net\</a\>&gt; wrote:\</span\>\<blockquote class="gmail\_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"\> \<br\>&gt;Vishnu Gopal wrote:\<br\>&gt; Hmm weird. Try a space after the ?, as in &quot;? &quot;.\<br\>\<br\>That returns the same error:\<br\>\<br\>&gt;&nbsp;&nbsp;SELECT \* FROM books&nbsp;&nbsp;ORDER BY ? isbn LIMIT 0, 10\<br\>\<br\>I can't believe this paginate issue hasn't been covered somewhere!&nbsp;&nbsp;My \<br\>searches only revealed that one thread posted above.\<br\>\<br\>--\<br\>Posted via \<a href="[http://www.ruby-forum.com/&quot;&gt;http://www.ruby-forum.com/&lt;/a&gt;\.&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;/blockquote&gt;&lt;/div&gt;&lt;br&gt](http://www.ruby-forum.com/&quot;&gt;http://www.ruby-forum.com/&lt;/a&gt;%5C.&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;/blockquote&gt;&lt;/div&gt;&lt;br&gt);
> 
> ------=\_Part\_45211\_14470071.1165240866527--

My preferred method for doing this is to pass a hash key in the sort parameter like...

/object/action?sort=name\_up

Then I do a lookup in the action...

sort = { 'name\_up' =\> 'name ASC', 'name\_down' =\>'name DESC' }

Object.find(:all, :order=\>sort[params[:sort]])

This way you don't have to worry about SQL injections and you can make complicated sort orders.

\_Kevin