# :conditions =\> \["phone like '%:phone%'" , {:phone =\> "555"}\]

**URL:** <https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359>\
**Category:** Rails\
**Created:** [March 20, 2006, 11:59am UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359 "2006-03-20T11:59:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aravet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/49beb7/32.png) [@aravet](https://www.ruby-forum.com/u/aravet)\
**Post date:** [March 20, 2006, 11:59am UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359/1 "2006-03-20T11:59:27Z")

</div>

Hi all,

What’s wrong with the way I specify the condition in :

```
 Person.find :all, :conditions => ["phone like '%:phone%'" , {:phone 

```

=\> “555”}]  
?

It translates to (note the two ’ between the two ")  
SELECT \* FROM people WHERE (phone like “%‘555’%” )

instead of  
SELECT \* FROM people WHERE (phone like “%555%” )

Another way to produce this problem:

OK :  
model = “555”  
conditions = “value like ‘%#{model}%’”

ERROR :  
model = “555”  
conditions = [“value like ‘%?%’”,model] ==\> WHERE (phone  
like “%‘555’%” )

What’s the write way to write this query?  
TIA

Alain

---

<div class="post-metadata">

**Author:** ![aravet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/49beb7/32.png) [@aravet](https://www.ruby-forum.com/u/aravet)\
**Post date:** [March 20, 2006, 12:03pm UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359/2 "2006-03-20T12:03:48Z")

</div>

Le Lundi 20 Mars 2006 11:59, Alain R. a écrit :

> Hi all,

Hi,

Try this :  
Person.find :all, :conditions =\> [“phone like ?”, “%” + phone + “%”]

I think it should work 🙂

---

<div class="post-metadata">

**Author:** ![aravet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/49beb7/32.png) [@aravet](https://www.ruby-forum.com/u/aravet)\
**Post date:** [March 20, 2006, 12:24pm UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359/3 "2006-03-20T12:24:38Z")

</div>

Thanks Loïc, it worked.

Alain

> Try this :  
> Person.find :all, :conditions =\> [“phone like ?”, “%” + phone +  
> “%”]

---

<div class="post-metadata">

**Author:** ![aravet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/49beb7/32.png) [@aravet](https://www.ruby-forum.com/u/aravet)\
**Post date:** [March 20, 2006, 2:54pm UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359/4 "2006-03-20T14:54:14Z")

</div>

Hi –

On Mon, 20 Mar 2006, Alain R. wrote:

> SELECT \* FROM people WHERE (phone like “%‘555’%” )
> 
> ERROR :  
> model = “555”  
> conditions = [“value like ‘%?%’”,model] ==\> WHERE (phone  
> like “%‘555’%” )
> 
> What’s the write way to write this query?

The way that works 🙂 Actually you can do this:

“value like ?”, “%#{model}%”

or equivalent, but I’d rather do “value like ‘%#{model}%’” in the  
first place (unless there’s an advantage to the ? technique that I’m  
not taking into account).

David

–  
David A. Black (removed\_email\_address@domain.invalid)  
Ruby Power and Light, LLC ([http://www.rubypowerandlight.com](http://www.rubypowerandlight.com))

“Ruby for Rails” chapters now available  
from Manning Early Access Program! [Ruby for Rails](http://www.manning.com/books/black)

---

<div class="post-metadata">

**Author:** ![aravet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/49beb7/32.png) [@aravet](https://www.ruby-forum.com/u/aravet)\
**Post date:** [March 20, 2006, 3:16pm UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359/5 "2006-03-20T15:16:18Z")

</div>

Hi –

On Mon, 20 Mar 2006, Erik van Oosten wrote:

> You should always use the form
> 
> “value like ?”, “%#{model}%”
> 
> to prevent problems. Model might contains a question mark or perhaps worse:  
> quotes.
> 
> Even if you know model never to contain special characters it is better to  
> get used to the form above. Next time, model is a value entered by a user,  
> leaving your site open for sql code injection attacks.

Indeed – I wasn’t factoring in the escape mechanism.

David

–  
David A. Black (removed\_email\_address@domain.invalid)  
Ruby Power and Light, LLC ([http://www.rubypowerandlight.com](http://www.rubypowerandlight.com))

“Ruby for Rails” chapters now available  
from Manning Early Access Program! [Ruby for Rails](http://www.manning.com/books/black)

---

<div class="post-metadata">

**Author:** ![aravet](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/49beb7/32.png) [@aravet](https://www.ruby-forum.com/u/aravet)\
**Post date:** [March 20, 2006, 3:07pm UTC](https://www.ruby-forum.com/t/conditions-phone-like-phone-phone-555/55359/6 "2006-03-20T15:07:35Z")

</div>

You should always use the form

```
"value like ?", "%#{model}%"

```

to prevent problems. Model might contains a question mark or perhaps  
worse: quotes.

Even if you know model never to contain special characters it is better  
to get used to the form above. Next time, model is a value entered by a  
user, leaving your site open for sql code injection attacks.

Another advantage is performance. Some databases cache compiled queries.  
When you put ‘model’ directly in the query, the query will be different  
everytime making caching impossible.

```
 Erik.
```