Question

I’m using the oursql Python library to talk to a MySQL database. I want to write code to search for users by name or email address. This is the code I have currently:

query = get_query()
cursor.execute("""
    SELECT *
      FROM users
     WHERE full_name LIKE '%?%'
        OR email LIKE '%?%';""", (query, query))

This code throws an exception:

ProgrammingError: 0 parameters expected, 2 given

Apparently the parser thinks the question mark is apart of the single-quoted string, and therefore isn’t doing the substitution. Any ideas on how to fix this?

Answer 1

The %‘s in the argument to LIKE are part of the data you want to pass to the DB-API module’s execute method, so they need to be part of the argument you pass for the placeholder, not part of the SQL query itself. For example:

query = '%%%s%%' % (get_query(),)
cursor.execute("""
    SELECT *
      FROM users
     WHERE full_name LIKE ?
        OR email LIKE ?;""", (query, query))