LIKE clause

rubyonrails-talk
1

Hello everybody, I would like to ask you if it is safe to use the LIKE clause as follow:

Artilce.find(:all, :conditions => [“title LIKE ?”, ‘%’ + params[:title] +‘%’])

Is it safe for sql iyection ? or do I need to escape all characters ???

Thanks in advance

2

Hi,

Yes that is safe. Was confused by this myself a couple of days ago.

Cheers, Johan

3

ok, thank you