GitHub

LIKE injection

Nov 3, 2015Ben Toews
LIKE injection
SummaryAI, from the source post

Introduced custom Ruby helpers (`like_sanitize`, `with_prefix`, `with_suffix`, `with_substring`) to escape SQL LIKE metacharacters (`%`, `_`) and prevent performance degradation and Denial of Service (DoS) vectors caused by unsanitized user input in LIKE clauses. Audited and fixed eleven existing LIKE queries.