Question

I have the following WHERE condition in a SELECT statement:

WHERE ('.' + column_name LIKE @prefix))

And the @prefix parameter is set as follows:

cmd.Parameters.AddWithValue("@prefix", "%[^a-z]" & prefix & "%")

The prefix variable is taken from form input.

The problem I’m having is when the user enters a ‘%’ or ‘[‘ or other special character. How can I make sure these are escaped rather than being treated as special characters?

Related: Generally, how do you stop people entering ‘%’ in their input and having this treated as a wildcard?

Answer 1

SQL’s LIKE operator provides an optional ESCAPE clause:

match_expression [ NOT ] LIKE pattern [ ESCAPE escape_character ]

You can set the escape character to a single character of your liking, and escape metacharacters with it.