0

i need to input a value into sql query, here is my code:

"UPDATE xxx SET status = (%s) WHERE author LIKE (%s)", ("OK", phone))

author value should start with value that i pass in 'phone' var

how should i write sql query in this case?

  • this seems relevent https://stackoverflow.com/questions/26393895/python-how-to-escape-s – feedthedogs Jan 07 '18 at 09:13
  • 1
    Possible duplicate of [how to safely generate a SQL LIKE statement using python db-api](https://stackoverflow.com/questions/2097475/how-to-safely-generate-a-sql-like-statement-using-python-db-api) – Ilja Everilä Jan 07 '18 at 09:20

1 Answers1

1

Append '%' to your variable.

phone = phone + '%'
Kaushik Nayak
  • 30,772
  • 5
  • 32
  • 45