I am writing an application in R that makes parameterized queries and sends them to a database to return the applicable information to a data table in the application. Because of the nature of a search query, I need to use the SQL term LIKE, with % signs around the search term. And to protect the database from SQL injection, I need to use the sqlInterpolate function. But I'm having issues with the way the sqlInterpolate function is making the query.
Right now, when I go into the R console, this works:
> sql <- sqlInterpolate(conn, "SELECT * FROM table WHERE Column1 LIKE '%000g7%'")
> dbGetQuery(conn, sql)
But this doesn't,
> str <- "000g7"
> sql <- sqlInterpolate(conn, "SELECT * FROM table WHERE Column1 LIKE '%?search%'", search = str)
> dbGetQuery(conn, sql)
it just returns an empty list. If I could get some help with the syntax of the query, I'd greatly appreciate it. I'm almost positive it has something to do with the apostrophes or something along those lines. Or if there is a better way to do this, I'm all ears.