I'd recommend you change:
Code:
@stories = Story.find :all, :conditions => "user_id = #{params[:id]}", :order => 'date_added DESC'
to
Code:
@stories = Story.find(:all, :conditions => ["user_id = ?", params[:id]], :order => 'date_added DESC')
The form you've used is susceptible to SQL injection attacks.
Personally, I'd use:
Code:
if params[:id] and user = User.find(params[:id])
@stories = Story.find(:all, conditions => ["user_id = ?", user], :order => 'date_added DESC')
else
#Some code that caught the fact that an invalid user id has been passed to the page
end
That way the user id is only used if a matching user can be found.
Bookmarks