Re: PreparedStatements, LIKE and the % operator - Mailing list pgsql-jdbc

From Thomas Kellerer
Subject Re: PreparedStatements, LIKE and the % operator
Date
Msg-id eq1ko7$v73$1@sea.gmane.org
Whole thread Raw
In response to PreparedStatements, LIKE and the % operator  ("j.random.programmer" <javadesigner@yahoo.com>)
List pgsql-jdbc
j.random.programmer wrote on 03.02.2007 04:58:
> Hi:
>
> I am using postgres 8.2 with the 8.2.504 jdbc3 driver.
>
> I am getting data from a untrusted source. Hence a
> prepared
> statement. I also need a partial match.
>
> String query =  " select * from table_foo where bar =
> LIKE %?% "
> PreparedStatement ps = con.prepareStatement(query);
> ps.setString(1, "haha");

That should be:

String query = "select * from table_foo where bar like ?";
PreparedStatement ps = con.prepareStatement(query);
ps.setString(1, "%haha%");

Thomas

pgsql-jdbc by date:

Previous
From: "j.random.programmer"
Date:
Subject: Re: PreparedStatements, LIKE and the % operator
Next
From: Barry Lind
Date:
Subject: Re: PreparedStatements, LIKE and the % operator