how to safely generate a SQL LIKE statement using python db-api

python, python-db-api, sql, sql-like

Solution

It's best to separate the parameters from the sql if you can. Then you can let the db module take care of proper quoting of the parameters.

sql='SELECT x FROM myTable WHERE x LIKE %s'
args=[beginningOfString+'%']
cursor.execute(sql,args)

Problem

I am trying to assemble the following SQL statement using python's db-api: ``` SELECT x FROM myTable WHERE x LIKE 'BEGINNING_OF_STRING%'; ``` where BEGINNING_OF_STRING should be a python var to be safely filled in through the DB-API. I tried ``` beginningOfString = 'abc' cursor.execute('SELECT x FROM myTable WHERE x LIKE '%s%', beginningOfString) cursor.execute('SELECT x FROM myTable WHERE x LIKE '%s%%', beginningOfString) ``` I am out of ideas; what is the correct way to do this?

Original source