Search code examples
sqlparameterswildcardsql-like

Wildcards in SQL parameter

I need to do a like search, in my SQL Server database. BUT, how do I do this, while still using parameters for my search value?

I am not talking about encapsulating in %'s. I need to be able to add a % in the middle of the search word.

WHERE title LIKE '%foo%bar%'

as an example, but with params.

Edit: To elaborate on the params: I am using MS SQL 2008, and C#, so it would be:

WHERE title LIKE '@SearchParam'

and @SearchParam would then be set to "%foo%bar%".

I hope that makes sense?

Solution

  • This works fine

    create proc dbo.lookupWild(@LIKEclause VARCHAR(20))
as
begin
    select * from teams where Name like @LIKEclause
end
go
exec lookupWild 'E%G%'

    And things like '1=1 -- drop table' are not SQL injected, they are just part of the wildcard search