Rails 4 LIKE query - ActiveRecord adds quotes

Question

I am trying to do a like query like so

def self.search(search, page = 1 )
  paginate :per_page => 5, :page =>          


        

Answer 1

ActiveRecord is clever enough to know that the parameter referred to by the ? is a string, and so it encloses it in single quotes. You could as one post suggests use Ruby string interpolation to pad the string with the required % symbols. However, this might expose you to SQL-injection (which is bad). I would suggest you use the SQL CONCAT() function to prepare the string like so:

"name LIKE CONCAT('%',?,'%') OR postal_code LIKE CONCAT('%',?,'%')", search, search)