sql 转义字符跑错的问题

app/controllers/stores_controller.rb

@@ -8,7 +8,7 @@ class StoresController < ApplicationController
     name = params[:name] ||= ''
     redirect_to stores_path, :notice => l(:field_course_un) if name.blank?
     # 按文件名搜索
-    result = Attachment.where("attachments.container_type IS NOT NULL AND filename LIKE '%" + name + "%' ").
+    result = Attachment.where("attachments.container_type IS NOT NULL AND filename LIKE :like ", like: "%#{name}%").
               reorder("created_on DESC")
     # result = result.to_a
     result.map { |res|