locate

Returns the index of the first occurrence of substring in this string expression or 0 if it doesn't contain substring.

substring is bound as a query parameter, except on Redshift, where it is written into the statement as a string literal with its single quotes escaped. Either way it is treated as data, so it must be passed as is, without being escaped on the client side.