rails/rails — pull request #14222 by D1plo1d (2014-02-27 18:34:37+00:00)
Title: SQL Like Escaping as a method on String

This would add the patch from #6104 (amended to include the \ escape character and || operator) to all Strings.

This does not have the backwards compatibility issues brought up in #6104 because it is a new helper method with no previous implementation to break.

IMO this should be a part of Rails so that the Rails team can iterate on a single sql injection protection implementation for like statements that covers edge cases that might not be immediately obvious.

The other option (the current option) is for developers such as myself to implement a potentially flawed DIY solution. Those edge cases (ex. db-specific special characters) are not going to be obvious at first but with many eyes they will be spotted.