sanitize search query

2026-08-09 16:01:12 +03:00
parent f35510ffd6
commit c59c470321
2 changed files with 3 additions and 2 deletions
@@ -93,7 +93,8 @@ module Submitters
  def plain_search(submitters, keyword)
    return submitters if keyword.blank?

-    term = "%#{keyword.downcase}%"
+    sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+    term = "%#{sanitized}%"

    arel_table = Submitter.arel_table