# How to use LIKE statement query-exec/list/value?

**URL:** <https://racket.discourse.group/t/how-to-use-like-statement-query-exec-list-value/763>\
**Category:** Questions & Answers\
**Tags:** question\
**Created:** [March 4, 2022, 11:46am UTC](https://racket.discourse.group/t/how-to-use-like-statement-query-exec-list-value/763 "2022-03-04T11:46:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hanson](https://yyz2.discourse-cdn.com/free1/user_avatar/racket.discourse.group/hanson/32/388_2.png) [@Hanson](https://racket.discourse.group/u/Hanson)\
**Post date:** [March 4, 2022, 11:46am UTC](https://racket.discourse.group/t/how-to-use-like-statement-query-exec-list-value/763/1 "2022-03-04T11:46:10Z")

</div>

How to use LIKE statement query-exec/list/value?  
If it's like  
`(query-list db "SELECT * FROM Table WHERE name LIKE '%?%'" name)` then '?' cannot be parsed. if format the statement by other function then there's a sql injection risk.

---

<div class="post-metadata">

**Author:** ![simonls](https://yyz2.discourse-cdn.com/free1/user_avatar/racket.discourse.group/simonls/32/170_2.png) [@simonls](https://racket.discourse.group/u/simonls)\
**Post date:** [March 4, 2022, 12:30pm UTC](https://racket.discourse.group/t/how-to-use-like-statement-query-exec-list-value/763/2 "2022-03-04T12:30:24Z")

</div>

Here is an example using sqlite:

```scheme
#lang racket/base

(require db
         racket/pretty)

(define (test)
  (define c (sqlite3-connect #:database 'memory #:mode 'create))

  (query-exec c "
CREATE TABLE IF NOT EXISTS example(
  id INTEGER NOT NULL PRIMARY KEY,
  title TEXT NOT NULL
);")

  (define (add-entry title)
    (query-exec c " INSERT INTO example (title) VALUES (?)" title))

  (add-entry "racket is a programming language")
  (add-entry "where can I buy a tennis racket?")
  (add-entry "do you like donuts?")
  (add-entry "the 10 best ways to cook ...")
  (add-entry "building your own #lang with racket")

  (define (find search)
    (pretty-print (query-rows c "SELECT * FROM example where title LIKE '%' || ? || '%'" search)))

  (find "racket"))

(module+ main
  (test))

```

This uses sqlite's concat operator `||` to add the `%` to the front and back of the string parameter.  
Other sql dialects usually have a `concat` function that can be used like this `concat('%', ?, '%')`

---

<div class="post-metadata">

**Author:** ![ryanc](https://yyz2.discourse-cdn.com/free1/user_avatar/racket.discourse.group/ryanc/32/71_2.png) [@ryanc](https://racket.discourse.group/u/ryanc)\
**Post date:** [March 4, 2022, 1:11pm UTC](https://racket.discourse.group/t/how-to-use-like-statement-query-exec-list-value/763/3 "2022-03-04T13:11:37Z")

</div>

Beware, though, that this is susceptible to _LIKE-regexp_ injection, if the search string contains unescaped LIKE-regexp characters (such as `%`).

For sqlite, you should use the [`instr`](https://www.sqlite.org/lang_corefunc.html#instr) function instead if you want to check whether one string occurs inside of another.

---

<div class="post-metadata">

**Author:** ![Hanson](https://yyz2.discourse-cdn.com/free1/user_avatar/racket.discourse.group/hanson/32/388_2.png) [@Hanson](https://racket.discourse.group/u/Hanson)\
**Post date:** [March 4, 2022, 2:36pm UTC](https://racket.discourse.group/t/how-to-use-like-statement-query-exec-list-value/763/4 "2022-03-04T14:36:29Z")

</div>

Further information: in mysql CONCAT() is available