Concat select query with like %string%

Question

Here is the simplified query that doesn't work.

SET @abc = CONCAT('%','string','%');

SET @query = CONCAT('SELECT * 
FROM table 
WHERE column LIKE ',@abc);

PREPARE stmt FROM @query;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

I need to use CONCAT with SELECT because there lots of other variables in real query.

Real query works fine when I use some simple COLUMN=xyz in WHERE clause. But nothing works when I try to use LIKE %xyz%...

Let me guess, do you use instead of `'string'` another column name? — Lukasz Szozda, Oct 20 '15 at 13:46
The feature you require is "dynamic SQL" - http://stackoverflow.com/questions/190776/how-to-have-dynamic-sql-in-mysql-stored-procedure — Neville Kuyt, Oct 20 '15 at 13:47

score 1 · Accepted Answer · answered Oct 20 '15 at 13:57

1

Use it like this

SET @abc = CONCAT('"%','string','%"');

SET @query = CONCAT('SELECT * 
 FROM table 
WHERE column LIKE ',@abc);

PREPARE stmt FROM @query;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

Check the first line I have added " to show @abc like "%string%"

answered Oct 20 '15 at 13:57

Arun Krish

2,153
1
10
15

How does this prevent against SQL injections? – Michael Apr 28 '22 at 18:28

Concat select query with like %string%

1 Answers1