Sql Statement With Like From Variable

I'm executing this code in python from sqlite3 import dbapi2 as sqlite con = sqlite.connect('db.sqlite') cur = con.cursor() surname = ''%atton%'' cur.execute('select id from singe

Solution 1:

The DB-API parameterization you use (which you should use, don't change that) means the surname will automatically be quoted or escaped appropriately. You should remove the inner set of quotes from your surname string.

surname = "%atton%"
cur.execute("select id from singers where surname like :surname",
    dict(surname=surname))