Question

On my web site, I need to perform a wild card query with a value provided by the end user. The best practice is to use a PreparedStatement mainly to avoid SQL Injection. My query is very very long so this is an example:

String query = "SELECT ... FROM ... WHERE ..."+ //
"AND UPPER(CUST_NAME) LIKE UPPER('%?%')";
PreparedStatement pstmt = conn.prepareStatement(query);
stmt.setString(1, "joe");

The problem is the setString() throws an exception: SQL Exception: Invalid column index

Answer 1

Instead of using the concat operator you could use

like upper('%' || ? || '%')

slightly more readable.