23

Using sqlite3, if my query is

SELECT * FROM table WHERE title LIKE '%x%'

It will match strings that contain x. I want to make x a bindable parameter, like:

SELECT * FROM table WHERE title LIKE '%x?%'

However, this does not work since the '' form a string literal. Is there some way of escaping the ? within the literal? I understand that I could build the bindable parameter to contain the % and then use

SELECT * FROM table WHERE title LIKE ?

but this moves the responsibility into my code in terms of handling SQL injections rather than the bind interface. Is there a nicer solution for this?

laalto
  • 150,114
  • 66
  • 286
  • 303
Steven Canfield
  • 7,312
  • 5
  • 35
  • 28

1 Answers1

45
SELECT * FROM table WHERE title LIKE '%' || ? || '%';
laalto
  • 150,114
  • 66
  • 286
  • 303
  • 5
    It's not just sqlite; `||` is in the SQL standard; Postgres and Oracle follow this. MySQL and MSSQL use `CONCAT()` and `+` respectively, both are non-standard. – ephemient Jul 09 '09 at 18:05