Question

Using sqlite3, if my query is

SELECT * FROM table WHERE title LIKE '%x%'

It will match strings that contain x. I want to make x a bindable parameter, like:

SELECT * FROM table WHERE title LIKE '%x?%'

However, this does not work since the '' form a string literal. Is there some way of escaping the ? within the literal? I understand that I could build the bindable parameter to contain the % and then use

SELECT * FROM table WHERE title LIKE ?

but this moves the responsibility into my code in terms of handling SQL injections rather than the bind interface. Is there a nicer solution for this?

Answer 1

SELECT * FROM table WHERE title LIKE '%' || ? || '%';