Question

I’m running the latest version of sinatra and ruby 1.9.3

I let users create a custom regex in my sinatra app.

code:

Posts.all(:message => %r{(?i)(.*)#{params[:searchterm]}(.*)})

How do I escape #{params[:searchterm]} so that the user can’t insert more regex?

(if the user searches for (.)*user he get’s results that shouldn’t work!

Answer 1

Use Regexp.escape to escape the variable value:

%r{(?i)(.*)#{Regexp.escape(params[:searchterm])}(.*)}