mirror of
https://github.com/GSA/notifications-api.git
synced 2026-02-23 11:29:50 -05:00
bdd77f9150
SQLAlchemy handles escaping anything that could allow a SQL injection
attack. But it doesn’t escape the characters used for wildcard
searching. This is the reason we’re able to do `.like('%example%')`
at all.
But we shouldn’t be letting our users search with wildcard characters,
so we need to escape them. Which is what this commit does.