title: Can I get Ecto to log raw SQL?
body: <p>I am building an Ecto query like this:</p>
  
  <pre><code>from item in query,
  where:  like(item.description, ^"%#{text}%")
  </code></pre>
  
  <p>I'm concerned that this allows SQL injection in <code>text</code>. Before trying to fix that, I want to see how the query is actually sent to the database.</p>
  
  <p>If I <a href="https://stackoverflow.com/questions/36770956/how-can-i-see-the-raw-sql-generated-for-an-ecto-query">inspect the query</a> or look at what is logged, I see some SQL, but it's not valid.</p>
  
  <p>For instance, inspecting the query shows me this:</p>
  
  <pre><code>{"SELECT i0.\"id\", i0.\"store_id\", i0.\"title\", i0.\"description\" 
    FROM \"items\" AS i0 WHERE (i0.\"description\" LIKE $1)",
   ["%foo%"]}
  </code></pre>
  
  <p>When I pass this query to <code>Repo.all</code>, it logs this:</p>
  
  <pre><code>SELECT i0."id", i0."store_id", i0."title", i0."description"
    FROM "items" AS i0 WHERE (i0."description" LIKE $1) ["%foo%"]
  </code></pre>
  
  <p>But if I copy and paste that into <code>psql</code>, PostgreSQL gives me an error:</p>
  
  <blockquote>
    <p>ERROR:  42P02: there is no parameter $1</p>
  </blockquote>
  
  <p>It seems as though Ecto may actually be doing a <a href="https://www.postgresql.org/docs/9.6/static/sql-prepare.html" rel="nofollow noreferrer">parameterized query</a>, like this:</p>
  
  <pre><code>PREPARE bydesc(text) AS SELECT i0."id", 
    i0."store_id", i0."title", i0."description" 
    FROM "items" AS i0 WHERE (i0."description" LIKE $1);
  EXECUTE bydesc('foo');
  </code></pre>
  
  <p>If so, I think that would prevent SQL injection. But I'm just guessing that this is what Ecto does.</p>
  
  <p>How can I see the actual SQL that Ecto is executing?</p>