Question

Im trying to form a sanitised query string in Python to use in SQLite3. It needs to take the ultimate form:

SELECT * FROM Players WHERE PlayerName LIKE '%bob%'

…so I can run a pattern search.

Ideally I want to have a ? in the query so I can then insert the search string when running the query and prevent Bobby Tables type events from occurring (not that I’ll have to worry about that tbh):

search_string = "bob"

query = "SELECT * FROM Players WHERE PlayerName LIKE '%?%'"

cur.execute(query, (search_string))

Running this gives me:

sqlite3.ProgrammingError: Incorrect number of bindings supplied. The
current statement uses 0, and there are 3 supplied.

So I’m pretty sure the issue is both with the use of the single quotes, percents and question marks but am fairly stuck – I can’t form the query so that python sees it needs a binding.

What is the best way round this or is there better practice for forming sanitised queries for pattern search in SQL?

UPDATE: final line was:

cur.execute(query, [('%' + search_string + '%')])

Answer 1

Use the lone placeholder ? after LIKE and wrap search_string with % during parameter assignment:

...
search_string = 'bob'
query = 'SELECT * FROM Players WHERE PlayerName LIKE ?'
cur.execute(query, ('%' + search_string + '%'))