字符串文字中的 Sqlite 绑定

2022-01-04 00:00:00 sql binding sqlite

使用 sqlite3，如果我的查询是

Using sqlite3, if my query is

SELECT * FROM table WHERE title LIKE '%x%'

它将匹配包含 x 的字符串.我想让 x 成为一个可绑定的参数，比如:

It will match strings that contain x. I want to make x a bindable parameter, like:

SELECT * FROM table WHERE title LIKE '%x?%'

然而，这不起作用，因为 '' 形成一个字符串文字.有没有办法在文字中转义 ? ?我知道我可以构建可绑定参数以包含 % 然后使用

However, this does not work since the '' form a string literal. Is there some way of escaping the ? within the literal? I understand that I could build the bindable parameter to contain the % and then use

SELECT * FROM table WHERE title LIKE ?

但是这将处理 SQL 注入而不是绑定接口的责任转移到我的代码中.有没有更好的解决方案?

but this moves the responsibility into my code in terms of handling SQL injections rather than the bind interface. Is there a nicer solution for this?

推荐答案

SELECT * FROM table WHERE title LIKE '%' || ? || '%';

相关文章