Escape user input before building regexps

app/controllers/recruitment_module_controller.rb

@@ -13,7 +13,7 @@ class RecruitmentModuleController < ApplicationController
 
     I18n.locale = :zh_tw
     if !params[:keyword].blank?
-      keyword = Regexp.new(".*"+params[:keyword]+".*")
+      keyword = Regexp.new(".*"+Regexp.escape(params[:keyword].to_s)+".*")
       recruitment = Recruitment.any_of({:title=>keyword},{:subtitle=>keyword},{:text=>keyword})
     else
       recruitment = Recruitment.all
@@ -21,7 +21,7 @@ class RecruitmentModuleController < ApplicationController
 
     if !params[:category].blank?
       module_id = ModuleApp.where(:key=>"recruitment").first.id
-      category = Regexp.new(".*"+params[:category]+".*")
+      category = Regexp.new(".*"+Regexp.escape(params[:category].to_s)+".*")
       category_id = Category.where(:title => category, :module_app_id => module_id).first.id
       recruitment = recruitment.where(:category_id => category_id)
     else
@@ -84,7 +84,7 @@ class RecruitmentModuleController < ApplicationController
 
     # 計算總筆數 Start
     if !params[:keyword].blank?
-      keyword = Regexp.new(".*"+params[:keyword]+".*")
+      keyword = Regexp.new(".*"+Regexp.escape(params[:keyword].to_s)+".*")
       recruitment = Recruitment.any_of({:title=>keyword},{:subtitle=>keyword},{:text=>keyword})
     else
       recruitment = Recruitment.all