refer: https://stackoverflow.com/questions/14824453/rails-raw-sql-example
搜索怎么在Rails3 使用row sql, 打开上面的链接,可以找到这样的答案,如下图:
sql = "Select * from ... your sql query here"
records_array = ActiveRecord::Base.connection.execute(sql)
可以在接口里使用,例如写:
class YourModel::Controller < ApplicationController
def test_sqli
sql = "select * from your_table_name where id = " + params[:my_id] + " or 1 = 1"
@blogs = ActiveRecord::Base.connection.execute(sql)
end
end
?