Rails字符串注入添加引号

Question

I am trying to enter a letter given by the get request into a Like statment in tails 3. So far I have the following code:

@entries = Entry.where("key LIKE '?%'", params[:letter]).order(:key)

Problem is it is creating the wrong kind of sql query adding quotation marks around the injected letter. it creates the following sql for :letter => 'a':

SELECT "entries".* FROM "entries" WHERE (key LIKE ''a'%') ORDER BY key

Instead of:

SELECT "entries".* FROM "entries" WHERE (key LIKE 'a%') ORDER BY key

How can I fix this?

Answer 1

@entries = Entry.where("key LIKE ?", "#{params[:letter]}%").order(:key)