# Function to escape queries?

**URL:** <https://www.ruby-forum.com/t/function-to-escape-queries/121909>\
**Category:** Rails\
**Created:** [December 2, 2007, 7:55pm UTC](https://www.ruby-forum.com/t/function-to-escape-queries/121909 "2007-12-02T19:55:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [December 2, 2007, 7:55pm UTC](https://www.ruby-forum.com/t/function-to-escape-queries/121909/1 "2007-12-02T19:55:31Z")

</div>

I am writing a raw query and need to escape a variable that the user can  
modify. Similar to :conditions =\> [“whatever = ?”, var]. What function  
does this use behind the scenes?

Thanks!

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [December 2, 2007, 8:15pm UTC](https://www.ruby-forum.com/t/function-to-escape-queries/121909/2 "2007-12-02T20:15:20Z")

</div>

On 2 Dec 2007, at 18:55, Ben J. wrote:

> I am writing a raw query and need to escape a variable that the user  
> can  
> modify. Similar to :conditions =\> [“whatever = ?”, var]. What function  
> does this use behind the scenes?

Depending on what you want:

connection#quote

ActiveRecord::Base#quote\_value

ActiveRecord::Base#sanitize\_sql (which turns [“whatever = ?”, var]  
into “whatever = ‘var’”

Fred