sanitize search query

app/controllers/submitters_autocomplete_controller.rb

@@ -36,7 +36,7 @@ class SubmittersAutocompleteController < ApplicationController
       else
         column = Submitter.arel_table[field.to_sym]
 
-        term = "#{params[:q].downcase}%"
+        term = "#{ActiveRecord::Base.sanitize_sql_like(params[:q].downcase)}%"
 
         submitters.where(column.matches(term))
       end

lib/submitters.rb

@@ -93,7 +93,8 @@ module Submitters
   def plain_search(submitters, keyword)
     return submitters if keyword.blank?
 
-    term = "%#{keyword.downcase}%"
+    sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+    term = "%#{sanitized}%"
 
     arel_table = Submitter.arel_table