ruby on rails sql injection on LIKE '%#{argument}% vulnerable?

Question

I have a question about ruby on rails sql injection vulnerability. let's say i have a method like this:

def self.search(args)
 where_clause = `items`.`name` LIKE '%#{args}%'
 results = Item::where(where_clause)
 return results
end

where args is a value passed in from the search box. is this vulnerable to attack? My initial thought was that this would be vulnerable to attack, however, after trying a few queries, I wasn't able to.

Is there something special about LIKE '%%' that makes it impervious to attack?

Thanks!

Answer 1

为了安全起见，我通常这样做：

Item.where("name LIKE ?", "%#{args}%")