Re: PreparedStatements, LIKE and the % operator

[Thomas Kellerer <spam_eater(at)gmx(dot)net>]

j.random.programmer wrote on 03.02.2007 04:58:
> Hi:
>
> I am using postgres 8.2 with the 8.2.504 jdbc3 driver.
>
> I am getting data from a untrusted source. Hence a
> prepared 
> statement. I also need a partial match.
>
> String query =  " select * from table_foo where bar =
> LIKE %?% "
> PreparedStatement ps = con.prepareStatement(query);
> ps.setString(1, "haha");

That should be:

String query = "select * from table_foo where bar like ?";
PreparedStatement ps = con.prepareStatement(query);
ps.setString(1, "%haha%");

Thomas