I'm trying to write LIKE query.
I read that pure string quires aren't safe, however I couldn't find any documentation that explain how to write safe LIKE Hash Query.
Is it possible? Should I manually defend against SQL Injection?
Join Stack Overflow to learn, share knowledge, and build your career.
I'm trying to write LIKE query.
I read that pure string quires aren't safe, however I couldn't find any documentation that explain how to write safe LIKE Hash Query.
Is it possible? Should I manually defend against SQL Injection?
To ensure that your query string gets properly sanitized, use the array or the hash query syntax to describe your conditions:
Foo.where("bar LIKE ?", "%#{query}%")
or:
Foo.where("bar LIKE :query", query: "%#{query}%")
If it is possible that the query
might include the %
character then you need to sanitize query
with sanitize_sql_like
first:
Foo.where("bar LIKE ?", "%#{sanitize_sql_like(query)}%")
Foo.where("bar LIKE :query", query: "%#{sanitize_sql_like(query)}%")
%
in the query string. It's not arbitrary "SQL injection" but still may function unexpectedly.
– Beni Cherniavsky-Paskin
Nov 16 '17 at 9:02
%
because the %
is part of the LIKE
syntax. If you escaped the %
then the result would basically be a normal =
query.
– spickermann
Nov 16 '17 at 9:05
query
variable, and in many cases you want to match literally the string in query
variable, not allow query
to use LIKE metacharacters. Let's take a more realistic example that %...%: the strings have a path-like structure, and you try to match /users/#{user.name}/tags/%
. Now if I arrange my username to be fr%d%
, I'll be able to observe fred
and frida
's tags...
– Beni Cherniavsky-Paskin
Nov 16 '17 at 9:16
sanitize_sql_like()
.
– Beni Cherniavsky-Paskin
Nov 16 '17 at 9:18
Using Arel you can perform this safe and portable query:
title = Model.arel_table[:title]
Model.where(title.matches("%#{query}%"))
Model.where(title.matches("%#{query}%").not)
works, although the generated SQL is a little awkward: WHERE (NOT (`models`.`title` LIKE '%foo%'))
– Noach Magedman
Feb 27 '18 at 13:00
Model.where(title.does_not_match("%#{query}%"))
. Generates: WHERE (`models`.`title` NOT LIKE '%foo%')
– Noach Magedman
Feb 27 '18 at 13:04
%
in untrusted input: >> ActiveRecord::VERSION::STRING => "5.2.3" >> field = Foo.arel_table[:bar] >> Foo.where(field.matches('%')).to_sql => "SELECT `foos`.* FROM `foos` WHERE `foos`.`bar` LIKE '%'"
– vjt
May 30 '19 at 17:33
Model.where.not(title.matches("%#{query}%"))
. does_not_match
reads better though, IMO.
– elquimista
Oct 25 '19 at 14:52
You can do
MyModel.where(["title LIKE ?", "%#{params[:query]}%"])
In case if anyone performing search query on nested association try this:
Model.joins(:association).where(
Association.arel_table[:attr1].matches("%#{query}%")
)
For multiple attributes try this:
Model.joins(:association).where(
AssociatedModelName.arel_table[:attr1].matches("%#{query}%")
.or(AssociatedModelName.arel_table[:attr2].matches("%#{query}%"))
.or(AssociatedModelName.arel_table[:attr3].matches("%#{query}%"))
)
Don't forget to replace AssociatedModelName
with your model name