difficulty setting loop based on params - ruby-on-rails

Question

Here is my controller:
def sedomain
#domain = params[:domain]
#virksomhed = Virksomhed.find(:all)
end
Virksomhed has_one Domain and Domain belongs_to Virksomhed.
That I am trying to achieve is looping through all rows in the domain table based on the params.
Here is a example for the dk domain page. It works fine.
<% #virksomhed.each do |virk| %>
<tr>
<td><%= virk.navn %></td>
<td><%= virk.domain.dk %> kr.</td>
<td><%= virk.domain.dkf %></td>
<td><%= virk.domain.dko %></td>
</tr>
<% end %>
But then I want to make it dynamic:
<% #virksomhed.each do |virk| %>
<tr>
<td><%= virk.navn %></td>
<td><%= virk.domain.#domain %> kr.</td>
<td><%= virk.domain.#domain %></td>
<td><%= virk.domain.#domain %></td>
</tr>
<% end %>
But I get a syntax error. I also think it is a bad solution because of users can access other columns in the Domain table via the params.

Answer 1

You can't dereference variables like this. What you mean to do is use send:
<td><%= virk.domain.send(#domain) %> kr.</td>
You will want to ensure that this user parameter conforms to a list of "known good" ones. There's two ways you might go about doing this, either pre-filtering and throwing an error if it's not valid, or having a method that eats the call quietly if it doesn't conform.
For instance:
#domain =
case(params[:domain])
when 'dk', 'dku', '...'
params[:domain]
else
raise "Hey, what are you doing?"
end

Answer 2

#tadman's answer is good, but i'd like to add my two cents. As #Emily said, you can store your whitelisted domains as a set in a Constant :
require 'set'
DOMAINS = Set.new( %W{dk dkf dko} )
As i understand it, your params[:domain] can either be an array or a string. to check if the domain is whitelisted, you can then do:
# ...
#domains= check_domains( params[:domain] )
# ...
def check_domains( dom )
case dom
when Array
dom if dom.to_set.subset?( DOMAINS )
else
[dom] if DOMAINS.include?( dom )
end
dom ||= []
end
then in your view (or maybe as some helper / partial):
<% if #domains.any? %>
<% #domains.each do |domain| %>
<td><%= virk.domain.send(domain) %> kr.</td>
<% end %>
<% end %>