Question

The only way I have been able to do a LIKE query in Rails 2.3 is the following:

access_points.all(:conditions => "mac_address LIKE '%#{@q}%'")

The official documentation says that this way of doing it is insecure because subject to SQL Injection:

Building your own conditions as pure strings can leave you vulnerable to SQL injection exploits. For example, Client.first(:conditions => “name LIKE ‘%#{params[:name]}%'”) is not safe. See the next section for the preferred way to handle conditions using an array.
http://guides.rubyonrails.org/v2.3.8/active_record_querying.html

But unfortunately it doesn’t explain how to do a LIKE query correctly and I haven’t been able to find it on google because LIKE is such a general keyword.

Any hint? I am new to Rails but I have experience with Symfony and Django.

Answer 1

This is how you want to do it:

:conditions => ['mac_address LIKE ?', "%#{@q}%"]