# Function to escape queries?

**URL:** <https://discuss.rubyonrails.org/t/function-to-escape-queries/21146>\
**Category:** rubyonrails-talk\
**Created:** [December 2, 2007, 7:14pm UTC](https://discuss.rubyonrails.org/t/function-to-escape-queries/21146 "2007-12-02T19:14:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frederick\_Cheung](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/frederick_cheung/32/3901_2.png) [@Frederick\_Cheung](https://discuss.rubyonrails.org/u/Frederick_Cheung)\
**Post date:** [December 2, 2007, 7:14pm UTC](https://discuss.rubyonrails.org/t/function-to-escape-queries/21146/1 "2007-12-02T19:14:19Z")

</div>

> I am writing a raw query and need to escape a variable that the user  
> can modify. Similar to :conditions =\> ["whatever = ?", var]. What function does this use behind the scenes?

Depending on what you want:

connection#quote

ActiveRecord::Base#quote\_value

ActiveRecord::Base#sanitize\_sql (which turns ["whatever = ?", var]  
into "whatever = 'var'"

Fred