Send a Wildcard Characters in python sql query through %s

Question

Code looks like this:

import mysql.connector

mydb = mysql.connector.connect(
  host="localhost",
  user="yourusername",
  passwd="yourpassword",
  database="mydatabase"
)

mycursor = mydb.cursor()

sql = """SELECT * FROM customers WHERE address LIKE '%way%'"""

mycursor.execute(sql)

myresult = mycursor.fetchall()

for x in myresult:
  print(x)

This will select all the records whose address contain care like "way".

How to insert the wildcard dynamically by using %s

Basically I want to know how to use %s instead of 'way' in python so that the code will be more flexible.

Visit https://stackoverflow.com/questions/3134691/python-string-formats-with-sql-wildcards-and-like — Rajat Kansal, Mar 27 '19 at 12:14

score 0 · Answer 1 · answered Mar 27 '19 at 12:13

0

try like below

 query ="SELECT * FROM customers   WHERE\
 address LIKE '%"+variable+"%'"

answered Mar 27 '19 at 12:13

Zaynul Abadin Tuhin

31,407
5
33
63

Quite sure the question asks 'how to use %s', not how to concatenate string. – The Pjot Mar 27 '19 at 12:16
How to use %s and passing the parameter to cursor.execute() to avoid any SQL injections. – shreesh katti Mar 28 '19 at 05:34

score 0 · Answer 2 · answered Mar 27 '19 at 12:15

0

Try escaping the percentage by doubling them.

>>> res = """SELECT * FROM customers WHERE address LIKE '%%%s%%'""" % ('way')
>>> res
"SELECT * FROM customers WHERE address LIKE '%way%'"

answered Mar 27 '19 at 12:15

The Pjot

1,801
1
12
20

Hi. How do I pass 'way' in cursor.execute(). That would prevent SQL injections – shreesh katti Mar 28 '19 at 04:59

Send a Wildcard Characters in python sql query through %s

2 Answers2