Escaping Quotes in Rails Query - ruby-on-rails

Question

I have Merchant Table which has the following fields
Merchant(id: integer, name: string, logo: string, description: text, categories: string, created_at: datetime, updated_at: datetime)
I want to run first_or_create query with name attribute. The problem is the name column contains single quotes, for example Brandy's Boy.
mname = "brandy's boy"
conds = "lower(name) = #{mname}"
Merchant.where(conds)
Merchant Load (1.5ms) SELECT "merchants".* FROM "merchants" WHERE "merchants"."deleted_at" IS NULL AND (lower(name) = 'brandy's boy ') LIMIT $1 [["LIMIT", 11]]
OutPut:
#<Merchant::ActiveRecord_Relation:0x000055d0f72a2ce0>
But this gives me the output when I run static query.
Merchant.where("lower(name) = ?", 'Brandy\'s Boy'.downcase)
Merchant Load (3.7ms) SELECT "merchants".* FROM "merchants" WHERE "merchants"."deleted_at" IS NULL AND (lower(name) = 'brandy''s boy') LIMIT $1 [["LIMIT", 11]]
#<ActiveRecord::Relation [#<Merchant id: 1413, name: "Brandy's Boy", logo: nil, description: "ABC", categories: [], created_at: "2020-07-17 07:32:29", updated_at: "2020-07-17 07:32:29">]>
But the variable mname is populated in a loop and it is dynamic. So in that case I need to escape the single quotes and get the desired result (existing Brandy's Boy Merchant Object)
Kindly help.

Answer 1

You don't need to interpolate to create the arguments for where, just bind it/them:
Merchant.where("lower(name) = ?", mname)
Active Record will take care of that and your query will most likely look like this:
SELECT "merchants".* FROM "merchants" WHERE (lower(name) = 'brandy''s boy')
Escaping is doing in the internals of the framework, from the docs:
If an array is passed, then the first element of the array is treated
as a template, and the remaining elements are inserted into the
template to generate the condition. Active Record takes care of
building the query to avoid injection attacks, and will convert from
the ruby type to the database type where needed. Elements are inserted
into the string in the order in which they appear.
User.where(["name = ? and email = ?", "Joe", "joe#example.com"])
# SELECT * FROM users WHERE name = 'Joe' AND email = 'joe#example.com';
Doing:
Merchant.where(["lower(name) = ?", mname])
Is pretty much the same as doing:
Merchant.where("lower(name) = ?", mname)
So your query is handled as stated above.