Does passing in params in my order clause leave me option to sql injection?

If I do this:

User.where(....).order("#{params[:order]} #{params[:dir]}")

If no, then for arguements sake say I want to be paranoid and ensure the values for the symbols :order and :dir are within a range, how could I do that?

Say I create an array of allowable safe values:

safe_order = %[:updated_at :created_a开发者_如何学Got]

what would be the ruby way of ensuring params[:order] is either nil or contains 1 of the values in the safe_order array?

Take a look at http://railscasts.com/episodes/228-sortable-table-columns

Specifically some small methods to check the parameters or return defaults:

 def index
   @products = Product.order(sort_column + " " + sort_direction)
 end

 # ...

 private

 def sort_column
   Product.column_names.include?(params[:sort]) ? params[:sort] : "name"
 end

 def sort_direction
   %w[asc desc].include?(params[:direction]) ? params[:direction] : "asc"
 end