Escape %_ using ActiveRecord::Sanitization

Charcoal-SE · May 28, 2018 · d11355b · d11355b
1 parent 91f2abb
commit d11355b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/helpers/search_helper.rb b/app/helpers/search_helper.rb
@@ -21,7 +21,7 @@ def self.parse_search_params(params, symbol, user)
       regex_support.each { |k, v| input = input.gsub(k, v) }
     else
       operation = 'LIKE'
-      input = '%' + input + '%'
+      input = '%' + ActiveRecord::Base.sanitize_sql_like(input) + '%'
     end
 
     [input, operation]