search for a vehicle by vin, make, model, or year, plus sql sanitization

app/models/vehicle.rb

@@ -50,9 +50,10 @@ class Vehicle < ActiveRecord::Base
     write_attribute(:vin, val)
   end
   
-  # search for a vin
-  def self.search(search)
-    where("vin LIKE ?", "%#{search}%")
+  # search for a vehicle by vin, make, model, or year
+  def self.search(query)
+    q = sanitize_sql_like(query)
+    where("vin LIKE ? OR make LIKE ? OR model LIKE ? OR year LIKE ?", "%#{q}%", "%#{q}%", "%#{q}%", "%#{q}%") 
   end
 	
   # decodes a vin and updates self

app/views/vehicles/_search.html.erb

@@ -1,4 +1,4 @@
 <%= form_tag(vehicles_path, method: "get", id: "search-form") do %>
-  <%= text_field_tag :search, params[:search], placeholder: t(:label_search_vin), autocomplete: "off" %>
+  <%= text_field_tag :search, params[:search], placeholder: t(:label_search), autocomplete: "off" %>
   <%= submit_tag t(:label_search) %>
 <% end %>