# Fabulous search routine from RailsSpace but missing 'LIKE' strategy?

**URL:** <https://www.ruby-forum.com/t/fabulous-search-routine-from-railsspace-but-missing-like-strategy/122548>\
**Category:** Rails\
**Created:** [December 9, 2007, 6:14am UTC](https://www.ruby-forum.com/t/fabulous-search-routine-from-railsspace-but-missing-like-strategy/122548 "2007-12-09T06:14:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 9, 2007, 6:14am UTC](https://www.ruby-forum.com/t/fabulous-search-routine-from-railsspace-but-missing-like-strategy/122548/1 "2007-12-09T06:14:00Z")

</div>

I’m having a wonderful time with the RailsSpace book and using their  
‘browse’ example to fashion my queries.  
Does anyone know how/if I can include a LIKE statement using this  
strategy? I’ve been searching the web all day and find this is a non-  
standard strategy as it seems to be open to SQL injection  
attacks…thus I included the sanitize\_sql methods to try to protect my  
database. Anyway, here’s the great code to run this;  
def self.find\_by\_search(params)  
where = []  
where \<\< sanitize\_sql(“zipcode = :zipcode”) unless  
params[:zipcode].blank?  
where \<\< sanitize\_sql(“city = :city”) unless  
params[:city].blank?  
where \<\< sanitize\_sql(“state = :state”) unless  
params[:state].blank?  
where \<\< sanitize\_sql(“county = :county”) unless  
params[:county].blank?  
if where.empty?  
[]  
else  
find(:all,  
:conditions =\> [where.join(" AND "), params],  
:order =\> params[:order])  
end  
end  
If anyone has any ideas how I could utilize a LIKE verb, I’d be  
grateful to hear.  
Thanks,  
Kathy