{"action":"created","issue":{"url":"https://api.github.com/repos/balderdashy/waterline/issues/899","labels_url":"https://api.github.com/repos/balderdashy/waterline/issues/899/labels{/name}","comments_url":"https://api.github.com/repos/balderdashy/waterline/issues/899/comments","events_url":"https://api.github.com/repos/balderdashy/waterline/issues/899/events","html_url":"https://github.com/balderdashy/waterline/issues/899","id":64400973,"number":899,"title":"Bug: `contains: \"%\"` always matches every row, but it shouldn't","user":{"login":"cspotcode","id":376504,"avatar_url":"https://avatars.githubusercontent.com/u/376504?v=3","gravatar_id":"","url":"https://api.github.com/users/cspotcode","html_url":"https://github.com/cspotcode","followers_url":"https://api.github.com/users/cspotcode/followers","following_url":"https://api.github.com/users/cspotcode/following{/other_user}","gists_url":"https://api.github.com/users/cspotcode/gists{/gist_id}","starred_url":"https://api.github.com/users/cspotcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cspotcode/subscriptions","organizations_url":"https://api.github.com/users/cspotcode/orgs","repos_url":"https://api.github.com/users/cspotcode/repos","events_url":"https://api.github.com/users/cspotcode/events{/privacy}","received_events_url":"https://api.github.com/users/cspotcode/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-26T00:11:54Z","updated_at":"2015-03-26T20:28:29Z","closed_at":null,"body":"This code returns all rows, but it shouldn't:\r\n```\r\nMyModel.find().where({name: {contains: \"%\"}}).exec(//...\r\n```\r\n\r\nI'm using MySQL.  EDIT: I can also confirm this behavior using blueprints and hitting the following URL:\r\n`.../api/user?where={%22name%22:{%22contains%22:%22%25%22}}`\r\n\r\nPossibly related to #802.\r\n\r\nThis function calls `normalize.likeCriteria`.  It seems to have been written in a hurry since the usage message is for `startsWith`, not `contains`.  Presumably `likeCriteria` should be escaping percent signs, but it's not.\r\nhttps://github.com/balderdashy/waterline/blob/4653f8a18016d2bcde9a70c90dd63a7c69381935/lib/waterline/query/finders/helpers.js#L61-L72\r\n\r\nHere's `likeCriteria`:\r\nhttps://github.com/balderdashy/waterline/blob/912734b0fbb05d179d7183c0932b83c8010cf4bc/lib/waterline/utils/normalize.js#L267-L286\r\n\r\nThis function is never called; not sure why: https://github.com/balderdashy/waterline/blob/4653f8a18016d2bcde9a70c90dd63a7c69381935/lib/waterline/utils/normalize.js#L383-L386\r\nEDIT: also that function doesn't make sense to me.  It will not touch percent signs at the beginning or end of the string, it won't touch adjacent percent signs, and it won't prefix percent signs with a backslash."},"comment":{"url":"https://api.github.com/repos/balderdashy/waterline/issues/comments/86701014","html_url":"https://github.com/balderdashy/waterline/issues/899#issuecomment-86701014","issue_url":"https://api.github.com/repos/balderdashy/waterline/issues/899","id":86701014,"user":{"login":"cspotcode","id":376504,"avatar_url":"https://avatars.githubusercontent.com/u/376504?v=3","gravatar_id":"","url":"https://api.github.com/users/cspotcode","html_url":"https://github.com/cspotcode","followers_url":"https://api.github.com/users/cspotcode/followers","following_url":"https://api.github.com/users/cspotcode/following{/other_user}","gists_url":"https://api.github.com/users/cspotcode/gists{/gist_id}","starred_url":"https://api.github.com/users/cspotcode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cspotcode/subscriptions","organizations_url":"https://api.github.com/users/cspotcode/orgs","repos_url":"https://api.github.com/users/cspotcode/repos","events_url":"https://api.github.com/users/cspotcode/events{/privacy}","received_events_url":"https://api.github.com/users/cspotcode/received_events","type":"User","site_admin":false},"created_at":"2015-03-26T20:28:29Z","updated_at":"2015-03-26T20:28:29Z","body":"In that case, what is the purpose of the waterline code I found?  Is it not being used?  I unfortunately don't have time to do more debugging or write a fix.  This bug does affect my work, so I will be grateful for a fix to be implemented.\r\n\r\nThanks in advance."}}