40

I have an SQL query as below.

Select * from table 
where name like '%' + search_criteria + '%' 

If search_criteria = 'abc', it will return data containing xxxabcxxxx which is fine.

But if my search_criteria = 'abc%', it will still return data containing xxxabcxxx, which should not be the case.

How do I handle this situation?

4
  • 1
    then why add your own %?
    – Randy
    May 29, 2012 at 16:58
  • how to do it depends on your engine, but obviously you have to escape your own %
    – Sebas
    May 29, 2012 at 17:00
  • what programming language are you using?
    – Jeshurun
    May 29, 2012 at 17:01
  • Use the MATCH instead of LIKE. Mar 9, 2017 at 9:50

8 Answers 8

35

If you want a % symbol in search_criteria to be treated as a literal character rather than as a wildcard, escape it to [%]

... where name like '%' + replace(search_criteria, '%', '[%]') + '%'
1
  • 1
    thank you, gives column with % sign select * from tablename where Column like '%[%]%'
    – Shaiju T
    Mar 18, 2015 at 11:42
14

Use an escape clause:

select *
  from (select '123abc456' AS result from dual
        union all
        select '123abc%456' AS result from dual
       )
  WHERE result LIKE '%abc\%%' escape '\'

Result

123abc%456

You can set your escape character to whatever you want. In this case, the default '\'. The escaped '\%' becomes a literal, the second '%' is not escaped, so again wild card.

See List of special characters for SQL LIKE clause

12

The easiest solution is to dispense with "like" altogether:

Select * 
from table
where charindex(search_criteria, name) > 0

I prefer charindex over like. Historically, it had better performance, but I'm not sure if it makes much of difference now.

2
  • 1
    I really like this answer, as it is clearly not vulnerable to SQL Injection, as you've avoided the string concatenation.
    – StuartQ
    Sep 23, 2013 at 13:02
  • 1
    check out sql-server-performance for a v short comparison. Note that using like 'findme%' can still use an index if it exists.
    – Scotty.NET
    Sep 26, 2013 at 10:18
6

To escape a character in sql you can use !:


EXAMPLE - USING ESCAPE CHARACTERS

It is important to understand how to "Escape Characters" when pattern matching. These examples deal specifically with escaping characters in Oracle.

Let's say you wanted to search for a % or a _ character in the SQL LIKE condition. You can do this using an Escape character.

Please note that you can only define an escape character as a single character (length of 1).

For example:

SELECT *
FROM suppliers
WHERE supplier_name LIKE '!%' escape '!';

This SQL LIKE condition example identifies the ! character as an escape character. This statement will return all suppliers whose name is %.

Here is another more complicated example using escape characters in the SQL LIKE condition.

SELECT *
FROM suppliers
WHERE supplier_name LIKE 'H%!%' escape '!';

This SQL LIKE condition example returns all suppliers whose name starts with H and ends in %. For example, it would return a value such as 'Hello%'.

You can also use the escape character with the _ character in the SQL LIKE condition.

For example:

SELECT *
FROM suppliers
WHERE supplier_name LIKE 'H%!_' escape '!';

This SQL LIKE condition example returns all suppliers whose name starts with H and ends in _ . For example, it would return a value such as 'Hello_'.


Reference: sql/like

2
Select * from table where name like search_criteria

if you are expecting the user to add their own wildcards...

2

You need to escape it: on many databases this is done by preceding it with backslash, \%.

So abc becomes abc\%.

Your programming language will have a database-specific function to do this for you. For example, PHP has mysql_escape_string() for the MySQL database.

0

Escape the percent sign \% to make it part of your comparison value.

1
  • This only works if you use the ESCAPE option of the LIKE operator. There is no default escape character (in SQL Server, anyway). Oct 28, 2015 at 16:20
0

May be this one help :)

DECLARE @SearchCriteria VARCHAR(25)
SET  @SearchCriteria = 'employee'
IF CHARINDEX('%', @SearchCriteria) = 0
BEGIN
SET @SearchCriteria = '%' + @SearchCriteria + '%'
END
SELECT * 
FROM Employee
WHERE Name LIKE @SearchCriteria

Not the answer you're looking for? Browse other questions tagged or ask your own question.