sql注入与搜索问题

app/controllers/subjects_controller.rb

@@ -23,19 +23,14 @@ class SubjectsController < ApplicationController
 
     # 最热排序
     if reorder == "myshixun_count"
+      subjects = Subject.joins(:shixuns).where(subjects: {hidden: 0, status: 2})
       if select
-        @subjects = Subject.find_by_sql("SELECT subjects.id, subjects.user_id, subjects.name, subjects.stages_count, subjects.repertoire_id, subjects.status,
-                      subjects.shixuns_count, subjects.excellent, sum(shixuns.myshixuns_count) AS myshixun_member_count FROM subjects join stage_shixuns
-                      on stage_shixuns.subject_id = subjects.id join shixuns on shixuns.id = stage_shixuns.shixun_id where
-                      subjects.hidden = 0 AND subjects.status = 2 AND subjects.name like '%#{search}%'
-                      AND subjects.repertoire_id = #{select} GROUP BY subjects.id ORDER BY myshixun_member_count DESC")
-      else
-        @subjects = Subject.find_by_sql("SELECT subjects.id, subjects.user_id, subjects.name, subjects.stages_count, subjects.repertoire_id, subjects.status,
-                      subjects.shixuns_count, subjects.excellent, sum(shixuns.myshixuns_count) AS myshixun_member_count FROM subjects join stage_shixuns
-                      on stage_shixuns.subject_id = subjects.id join shixuns on shixuns.id = stage_shixuns.shixun_id where
-                      subjects.hidden = 0 AND subjects.status = 2 AND subjects.name like '%#{search}%'
-                      GROUP BY subjects.id ORDER BY myshixun_member_count DESC")
+        subjects = subjects.where(subjects: {repertoire_id: select})
+      end
+      if search
+        subjects = subjects.where("subjects.name like ?", "%#{search}%")
       end
+      @subjects = subjects.select("subjects.*, sum(shixuns.myshixuns_count) AS myshixun_member_count").group_by("subjects.id").order("myshixun_member_count DESC")
     else
       # 我的路径
       if reorder == "mine"
@@ -51,7 +46,6 @@ class SubjectsController < ApplicationController
       else
         @subjects = Subject.visible.unhidden
       end
-
       # 类型
       if select
         @subjects = @subjects.where(repertoire_id: select)