I hear the warnings around the dangers of like injection.
I figured out how to alternatively write the queries I need for these cases using Ecto fragments and PostgreSQL’s own string functions like position() and lower().
However, it would be nice to able to use like/ilike… Can anybody see any remaining risks if we sanitized the user input with the following function (using @LostKobrakai’s proposed approach above, plus sanitizing for nil)?
sanitized_user_input = Regex.replace(~r/^$|([\%_])/, raw_user_input, "[\\1]")
but mostly because I am just temporarily using ILIKE and will move to SIMILARITY soon.
