How to prevent LIKE-injections

Questions & Help Questions
,
14

So, everyone is cooking their own flawed escape code instead of centralizing this on ecto :eyes:

For now i’m going with

String.contains?(user_query, ["\\", "%", "_"])
... raise Ecto.NoResultsError, queryable: "unsafe redacted"

:person_shrugging: but mostly because I am just temporarily using ILIKE and will move to SIMILARITY soon.

in context:

  def search(user_query) do
    case String.contains?(user_query, ["\\", "%", "_"]) do # TODO: move to app config in case you change db backend?
      true -> raise Ecto.NoResultsError, queryable: "unsafe redacted"
      false ->
        name_pattern = "#{user_query}%"
        Content
        |> where(ilike("name", ^name_pattern))
        |> limit(10)
        |> Repo.all
    end
  end