Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Sqlite binding within string literal

Tags:

Using sqlite3, if my query is

SELECT * FROM table WHERE title LIKE '%x%'

It will match strings that contain x. I want to make x a bindable parameter, like:

SELECT * FROM table WHERE title LIKE '%x?%'

However, this does not work since the '' form a string literal. Is there some way of escaping the ? within the literal? I understand that I could build the bindable parameter to contain the % and then use

SELECT * FROM table WHERE title LIKE ?

but this moves the responsibility into my code in terms of handling SQL injections rather than the bind interface. Is there a nicer solution for this?

like image 389
Steven Canfield Avatar asked Jul 09 '09 17:07

Steven Canfield


1 Answers

SELECT * FROM table WHERE title LIKE '%' || ? || '%'; 
like image 144
laalto Avatar answered Sep 20 '22 09:09

laalto