You should also review the API documentation and abide by the rules. In this case, for the code you can send to the where method.
This should work:
@projects = Project.where("manager_user_id = '#{current_user.id}' or account_manager_id = '#{current_user.id}'")
This should be safe, since I assume that the value of current_user id comes from your own application, and not from an external source, such as form submissions. If you use the form data that you intend to use in your queries, you must use placeholders so that Rails creates properly shielded SQL.
# with placeholders @projects = Project.where(["manager_user_id = ? or account_manager_id = ?", some_value_from_form1, some_value_from_form_2])
When you pass a few parameters to the where method (an example with placeholders), the first parameter will be processed by Rails as a template for SQL. The remaining elements in the array will be replaced at run time by the number of placeholders (?) That you use in the first element, which is the template.
source share