How to handle IN-condition with Sequel.lit avoiding SQL injections?

[wuarmin]

Hey,
I'm curious about how to handle the following correctly, without introducing vulnerabilities:

relation.where(Sequel.lit('id IN ?', "('1', '2')"))

the above code produces:

WHERE id IN '(''1'', ''2'')'

I know, this should be solved with Sequel DSL, but I want to know how I can achieve it with Sequel.lit

Do you have to use a prepared statement?

I found this answer at SO: https://stackoverflow.com/questions/29856697/how-do-i-pass-a-variable-into-a-prepared-statement-in-ruby
Is this the answer and the right way to achieve this?

Thanks and best regards

[janko]

You can pass the array as the parameter:

relation.where(Sequel.lit('id IN ?', ['1', '2']))

AFAIK, ruby arrays will be converted into (e1, e2, ...) in most places in Sequel.

[wuarmin]

Great! Thank you for your answer.