From: Paul <paul.vaillant@...>
Date: 2005-09-28T01:06:43+09:00
Subject: Re: RAILS question, sql statements

You could also just add the % characters to the passed value and use
the ? in the sql statement.

q_firstname = '%' + first_name + '%'
q_lastname = '%' + last_name + '%'

@employee_pages, @employees = paginate (:employee, :conditions =>
["firm_id = ? and first_name like ? and last_name like ?" , firm_id,
q_firstname, q_lastname] , :order_by => "last_name ASC", :per_page =>
10)

This way, the value passed in as first_name and last_name will be
escaped properly.