Safe ActiveRecord like query
To ensure that your query string gets properly sanitized, use the array or the hash query syntax to describe your conditions: Foo.where(“bar LIKE ?”, “%#{query}%”) or: Foo.where(“bar LIKE :query”, query: “%#{query}%”) If it is possible that the query might include the % character and you do not want to allow it (this depends on your … Read more