escape ilike params in cars route

encar_scraper/api/routes/cars.py

@@ -28,9 +28,11 @@ def list_cars(
         query = select(Car)
 
         if brand:
-            query = query.where(Car.brand.ilike(f"%{brand}%"))
+            escaped_brand = brand.replace("%", r"\%").replace("_", r"\_")
+            query = query.where(Car.brand.ilike(f"%{escaped_brand}%", escape="\\"))
         if model:
-            query = query.where(Car.model.ilike(f"%{model}%"))
+            escaped_model = model.replace("%", r"\%").replace("_", r"\_")
+            query = query.where(Car.model.ilike(f"%{escaped_model}%", escape="\\"))
         if year_min is not None:
             query = query.where(Car.year >= year_min)
         if year_max is not None:
@@ -62,7 +64,9 @@ def get_car(
 ):
     # Детальная информация об автомобиле с изображениями
     with persistence.session_scope() as session:
-        car = session.get(Car, car_id)
+        car = session.execute(
+            select(Car).options(selectinload(Car.images)).where(Car.id == car_id)
+        ).scalars().first()
         if car is None:
             raise HTTPException(status_code=404, detail="Car not found")
         return CarRead.model_validate(car).model_dump(mode="json")
@@ -76,7 +80,7 @@ def get_car_by_origin(
     # Поиск автомобиля по origin_id
     with persistence.session_scope() as session:
         car = session.execute(
-            select(Car).where(Car.origin_id == origin_id)
+            select(Car).options(selectinload(Car.images)).where(Car.origin_id == origin_id)
         ).scalars().first()
         if car is None:
             raise HTTPException(status_code=404, detail="Car not found")