SQL Like escaping helper method. [Rob Gilson & Yves Senn]

Closes #14222.

This is a follow up to #6104

This does not have the backwards compatibility issues brought up in
implementation to break.

1 files changed, 6 insertions, 0 deletions

diff --git a/activerecord/lib/active_record/sanitization.rb b/activerecord/lib/active_record/sanitization.rb
index 5a71c13d91..ef63949208 100644
--- a/activerecord/lib/active_record/sanitization.rb
+++ b/activerecord/lib/active_record/sanitization.rb
@@ -107,6 +107,12 @@ module ActiveRecord
         end.join(', ')
       end
 
+      # Sanitizes a +string+ so that it is safe to use within a sql
+      # LIKE statement. This method uses +escape_character+ to escape all occurrences of "\", "_" and "%"
+      def sanitize_sql_like(string, escape_character = "\\")
+        string.gsub(/[\\_%]/) { |x| [escape_character, x].join }
+      end
+
       # Accepts an array of conditions. The array has each value
       # sanitized and interpolated into the SQL statement.
       #   ["name='%s' and group_id='%s'", "foo'bar", 4]  returns  "name='foo''bar' and group_id='4'"