diff --git a/app/models/query.rb b/app/models/query.rb
index c49e4f4d1..b1a98b77d 100644
--- a/app/models/query.rb
+++ b/app/models/query.rb
@@ -1441,6 +1441,7 @@ class Query < ActiveRecord::Base
     prefix = '%' if options[:ends_with]
     suffix = '%' if options[:starts_with]
     prefix = suffix = '%' if prefix.nil? && suffix.nil?
+    value = queried_class.sanitize_sql_like value
     queried_class.send(
       :sanitize_sql_for_conditions,
       [Redmine::Database.like(db_field, '?', :match => options[:match]), "#{prefix}#{value}#{suffix}"])
diff --git a/test/unit/query_test.rb b/test/unit/query_test.rb
index ccf30f477..767cf36ba 100644
--- a/test/unit/query_test.rb
+++ b/test/unit/query_test.rb
@@ -2811,4 +2811,19 @@ class QueryTest < ActiveSupport::TestCase
       end
     end
   end
+
+  def test_sql_contains_should_escape_value
+    i = Issue.generate! subject: 'Sanitize test'
+    query = IssueQuery.new(:project => nil, :name => '_')
+    query.add_filter('subject', '~', ['te%t'])
+    assert_equal 0, query.issue_count
+
+    i.update_column :subject, 'Sanitize te%t'
+    assert_equal 1, query.issue_count
+
+    i.update_column :subject, 'Sanitize te_t'
+    query = IssueQuery.new(:project => nil, :name => '_')
+    query.add_filter('subject', '~', ['te_t'])
+    assert_equal 1, query.issue_count
+  end
 end