SQL LIKE in Django/Python

Question

I'm trying to run a query like this:

SELECT * 
FROM 
    MyTable 
WHERE 
    FirstName LIKE '%[user inputted value here]%' 
    OR 
    LastName LIKE '%[that same user inputted value]%' 
    AND 
    UserID = some number

When I run the query using cursor.execute(), the inputted values are going to be escaped and quoted, which is causing an incorrect query to run. Is there a way to prevent the user inputted values from being quoted?

I'd prefer a solution not using Django's ORM, since the actual query is much more complicated than my example.

Is this MySQLdb? Can you show us what you mean by 'escaped and quoted'? — Joe Holloway
– Joe Holloway, Commented Feb 6, 2010 at 2:40
What's the query? There's a good chance it can be done using the ORM... — Zach
– Zach, Commented Feb 8, 2010 at 22:56

Ignacio Vazquez-Abrams · Accepted Answer · 2010-02-06 02:06:09Z

2

Use foo__contains=realvaluehere in your queries.

answered Feb 6, 2010 at 2:06

Ignacio Vazquez-Abrams

804k160 gold badges1.4k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Matt · Accepted Answer · 2010-02-06 17:44:16Z

1

Hmm, looks like I overestimated the escapy-ness of the API. This works exactly how I want it to

# add wildcards to query, these are **not** escaped
q = "%" + q + "%"
cursor = connection.cursor()
cursor.execute("SELECT * 
                FROM MyTable 
                WHERE 
                  LastName LIKE %s 
                  AND 
                  FirstName LIKE %s 
                  AND 
                  UserID = %s", [q, q, user_id])
results = cursor.fetchall()

answered Feb 6, 2010 at 17:44

Matt

213 bronze badges

Collectives™ on Stack Overflow

SQL LIKE in Django/Python

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related