问题描述
使用 sqlite3，如果我的查询是
Using sqlite3, if my query is
SELECT * FROM table WHERE title LIKE '%x%'
它将匹配包含 x 的字符串.我想让 x 成为一个可绑定的参数，比如:
It will match strings that contain x. I want to make x a bindable parameter, like:
SELECT * FROM table WHERE title LIKE '%x?%'
然而，这不起作用，因为 '' 形成一个字符串文字.有没有办法在文字中转义 ? ?我知道我可以构建可绑定参数以包含 % 然后使用
However, this does not work since the '' form a string literal. Is there some way of escaping the ? within the literal? I understand that I could build the bindable parameter to contain the % and then use
SELECT * FROM table WHERE title LIKE ?
但是这将处理 SQL 注入而不是绑定接口的责任转移到我的代码中.有没有更好的解决方案?
but this moves the responsibility into my code in terms of handling SQL injections rather than the bind interface. Is there a nicer solution for this?
推荐答案
SELECT * FROM table WHERE title LIKE '%' || ? || '%';
这篇关于字符串文字中的 Sqlite 绑定的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持编程学习网！