Escape LIKE Wildcards with sanitize_sql_like

When you add a search box backed by a LIKE or ILIKE query, user input can change the pattern. A search for 100% returns every row containing 100 . A bare % returns the whole table. Active Record’s sanitize_sql_like fixes this. Instead of… …dropping the user’s term straight into the pattern: class Article < ApplicationRecord scope :containing_text , -> ( query ) { where ( "articles.title ILIKE :q" , q: "% #{ query } %" ) } end Article . containing_text ( "100%" ) # also matches "100 days...