PgSql: escape % and _ in Contains/StartsWith (ILIKE)

[mmalkhatib]

The PgSql variant turns Searchy Contains / StartsWith into EF.Functions.ILike(col, "%v%") / "v%" without escaping the value, so a % or _ the user typed acts as a wildcard. The two-argument ILike also makes Npgsql emit ESCAPE '', which turns escaping off entirely, so callers can't pre-escape either.

This change escapes \, % and _ in the value and calls the three-argument ILike with \ as the escape character. That matches the literal semantics of the core package's string.Contains / StartsWith.

Filter	SQL	Rows before → after
Contains a_c	ILIKE '%a\_c%' ESCAPE '\'	19 (wildcard) → 0
StartsWith ro123456_	ILIKE 'ro123456\_%' ESCAPE '\'	— → 3 (real RO123456_01)
Contains 456%01	ILIKE '%456\%01%' ESCAPE '\'	→ 0
Contains l18094333	ILIKE '%l18094333%' ESCAPE '\'	2 → 2

Trigram GIN indexes are still used (Index Cond: number ~~* '...'); Postgres folds ESCAPE '\' into the default.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9f82e5e8-3c5a-44c4-b785-79b116bee8df

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}