sql注入问题

app/queries/weapps/subject_query.rb

@@ -33,10 +33,10 @@ class Weapps::SubjectQuery < ApplicationQuery
   private
 
   def order_type
-    params[:order] || "updated_at"
+    params[:order] == "updated_at" ? "updated_at" : "myshixuns_count"
   end
 
   def sort_type
-    params[:sort] || "desc"
+    params[:sort] == "desc" ? "desc" : "asc"
   end
 end