题库列表SQL注入问题

app/controllers/question_banks_controller.rb

@@ -18,19 +18,17 @@ class QuestionBanksController < ApplicationController
             # 已认证才能获取题库
             if @certification_teacher
               sql = %Q{
-              #{@objects.table_name}.is_public = 1 and concat(#{@objects.table_name}.name, course_lists.name) like
+                #{@objects.table_name}.is_public = 1 and concat(#{@objects.table_name}.name, course_lists.name) like :keyword
-                    '%#{params[:search]}%'
+              }
-                  }
+              @objects.joins(:course_list).where(sql, keyword: "%#{params[:search]}%")
-              @objects.joins(:course_list).where(sql)
             else
               @objects.none
             end
           else
             sql = %Q{
-            #{@objects.table_name}.user_id = #{current_user.id} and concat(#{@objects.table_name}.name, course_lists.name) like
+                #{@objects.table_name}.user_id = #{current_user.id} and concat(#{@objects.table_name}.name, course_lists.name) like :keyword
-                    '%#{params[:search]}%'
+            }
-                  }
+            @objects.joins(:course_list).where(sql, keyword: "%#{params[:search]}%")
-            @objects.joins(:course_list).where(sql)
           end
         else
           if params[:filter] == 'public'