# LIKE SQL queries in rails

**URL:** <https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994>\
**Category:** Rails\
**Created:** [December 11, 2005, 5:46pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994 "2005-12-11T17:46:35Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [December 11, 2005, 5:46pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/1 "2005-12-11T17:46:35Z")

</div>

I’m trying to do something like:

SELECT \* FROM attachment WHERE filename LIKE ‘%whatever%’;

so my code is:

@search = params[:search]  
@attachments = Attachment.find(:all, :conditions =\> [“filename LIKE  
‘%?%’”, @search.to\_s])

but that’s converting to:

SELECT \* FROM attachments WHERE (filename LIKE ‘%‘whatever’%’);

how do i prevent those extra single quotes from being inserted?  
thanks!  
steve

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [December 11, 2005, 5:47pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/2 "2005-12-11T17:47:45Z")

</div>

Stephen Karsch wrote:

> I’m trying to do something like:
> 
> SELECT \* FROM attachment WHERE filename LIKE ‘%whatever%’;
> 
> so my code is:
> 
> @search = params[:search]  
> @attachments = Attachment.find(:all, :conditions =\> [“filename LIKE  
> ‘%?%’”, @search.to\_s])

Try  
Attachment.find(:all, :conditions =\> [“filename LIKE ‘?’”, ‘%’ +  
@search.to\_s + ‘%’])

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [December 11, 2005, 5:53pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/3 "2005-12-11T17:53:37Z")

</div>

±le 11/12/2005 17:47 +0100, Andreas S. écrivait :  
| Stephen Karsch wrote:  
|\> I’m trying to do something like:  
|\>  
|\> SELECT \* FROM attachment WHERE filename LIKE ‘%whatever%’;  
|\>  
|\> so my code is:  
|\>  
|\> @search = params[:search]  
|\> @attachments = Attachment.find(:all, :conditions =\> [“filename LIKE  
|\> ‘%?%’”, @search.to\_s])  
|  
| Try  
| Attachment.find(:all, :conditions =\> [“filename LIKE ‘?’”, ‘%’ +  
| @search.to\_s + ‘%’])

‘…LIKE ?’

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [April 17, 2006, 5:33pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/4 "2006-04-17T17:33:10Z")

</div>

On Apr 17, 2006, at 6:47 AM, Tim P. wrote:

> Dan that way leaves you open for SQL injection attacks 🙂
> 
> using the [x=?], var way is much safer as rails protects you.

But…Dan _is_ using placeholders.

Would it be different if he said:

@attachments = Attachment.find(:all, :conditions =\> [“filename  
LIKE %?%”, @search}])

I don’t think that would work with true placeholders, but  
it might work with Rails.

–  
– Tom M.

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [April 17, 2006, 5:54pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/5 "2006-04-17T17:54:38Z")

</div>

On Apr 17, 2006, at 11:30 AM, Tom M. wrote:

> > >
> 
> @attachments = Attachment.find(:all, :conditions =\> [“filename  
> LIKE %?%”, @search}])
> 
> I don’t think that would work with true placeholders, but  
> it might work with Rails.

What about:

@attachments = Attachment.find(:all, :conditions =\> [“filename  
LIKE ?”, ‘%’ + @search + ‘%’])

You like? (pun intended only sub-consciously)

-Derrick S.

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [April 17, 2006, 8:14pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/6 "2006-04-17T20:14:21Z")

</div>

On Apr 17, 2006, at 8:53 AM, Derrick S. wrote:

> > > >
> > 
> > Would it be different if he said:  
> > LIKE ?", ‘%’ + @search + ‘%’])
> 
> You like? (pun intended only sub-consciously)

Identical end result to this from above:

> > > > @attachments = Attachment.find(:all, :conditions =\> [“filename  
> > > > LIKE ?”,  
> > > > “%#{@search}%”])

Color me prejudiced, but I do prefer your version. Ruby string  
interpolation  
is painfully hard to look at IMHO.

–  
– Tom M.

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [April 17, 2006, 3:47pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/7 "2006-04-17T15:47:24Z")

</div>

Dan F. wrote:

> I’m not a rails expert but I think you could do:
> 
> @attachments = Attachment.find(:all, :conditions =\> [“filename LIKE ?”,  
> “%#{@search}%”])
> 
> Not sure if this is the best way but it should work.
> 
> Dan

Dan that way leaves you open for SQL injection attacks 🙂

using the [x=?], var way is much safer as rails protects you.

Tim

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [December 12, 2005, 2:57am UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/8 "2005-12-12T02:57:16Z")

</div>

I’m not a rails expert but I think you could do:

@attachments = Attachment.find(:all, :conditions =\> [“filename LIKE ?”,  
“%#{@search}%”])

Not sure if this is the best way but it should work.

Dan

---

<div class="post-metadata">

**Author:** ![Stephen\_Karsch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ba8739/32.png) [@Stephen\_Karsch](https://www.ruby-forum.com/u/Stephen_Karsch)\
**Post date:** [December 11, 2005, 5:54pm UTC](https://www.ruby-forum.com/t/like-sql-queries-in-rails/49994/9 "2005-12-11T17:54:17Z")

</div>

Mathieu A. wrote:

> ±le 11/12/2005 17:47 +0100, Andreas S. �crivait :  
> | Stephen Karsch wrote:  
> |\> I’m trying to do something like:  
> |\>  
> |\> SELECT \* FROM attachment WHERE filename LIKE ‘%whatever%’;  
> |\>  
> |\> so my code is:  
> |\>  
> |\> @search = params[:search]  
> |\> @attachments = Attachment.find(:all, :conditions =\> [“filename LIKE  
> |\> ‘%?%’”, @search.to\_s])  
> |  
> | Try  
> | Attachment.find(:all, :conditions =\> [“filename LIKE ‘?’”, ‘%’ +  
> | @search.to\_s + ‘%’])
> 
> ‘…LIKE ?’

Yes, that’s what I meant.