---
title: "Parameterized string and wildcards in MySQL"  
description: "Parameterized string and wildcards in MySQL"  
author: "Anonymous User"  
published: 2014-12-26  
updated: 2014-12-26  
canonical: https://www.mindstick.com/forum/12819/parameterized-string-and-wildcards-in-mysql  
category: ".net"  
tags: [".net", "mysql", "string"]  
reading_time: 2 minutes  

---

# Parameterized string and wildcards in MySQL

I'm trying to build a MySQL query for a [database](https://www.mindstick.com/articles/12226/use-of-database-in-sencha-extjs-and-insert-record-from-user-form-using-ajax) search [operation](https://www.mindstick.com/forum/33917/how-to-callback-operation-using-delegate-in-c-sharp), where a user can specify a text string to [match against](https://answers.mindstick.com/qa/38806/name-the-english-all-rounder-who-scored-the-second-fastest-test-double-hundred-in-163-balls-during-the-2nd-test-match-against-south-africa) a particular column. I figured that using the LIKE [operator](https://www.mindstick.com/blog/144/union-intersection-and-except-operator-in-sql-server) and surrounding the [user input](https://www.mindstick.com/forum/159624/setting-an-enum-from-user-input) with % signs, to act as wildcards, would be best practice. I want the wildcards to be there on both the start and end so the user does not have to enter the whole string. Furthermore, I'd like to parameterize the query to avoid injection and whatnot. This leaves me with a query that looks something like this:\
SELECT * FROM `sometable`WHERE `name` LIKE ?ORDER BY `id` ASCLIMIT 1,10(Note that the name column is a VARCHAR(50) with [collation](https://www.mindstick.com/interview/2273/what-are-different-types-of-collation-sensitivity) utf8_general_ci.)\
The [parameter](https://www.mindstick.com/blog/450/parameter-class-in-c-sharp) from the [WHERE clause](https://www.mindstick.com/interview/1909/when-do-you-use-where-clause-and-when-do-you-use-having-clause) is added like so:\
Using cmd As New OdbcCommand() cmd.Parameters.AddWithValue("name", "%" & strUserInput & "%") ...However, what I now ended up with appears to be MySQL actually matching the name [column against](https://www.mindstick.com/forum/158942/how-do-you-use-the-in-operator-to-compare-a-column-against-a-list-of-values-in-sql) the concatenated string, treating the %'s as literals and not as wildcards as I had intended. I also tried LIKE CONCAT('%', ?, '%'), but this doesn't work either.\
How would I glue a wildcard [character](https://www.mindstick.com/articles/23551/an-investigate-distinctive-seafood-restaurant-for-your-image-stamp-character) to the start and end of a parameterized string? Or is there a much better way of doing this?

## Replies

### Reply by Anonymous User

Your SqlParameter name is @name not name : cmd.Parameters.AddWithValue("@name", string.Format("%{0}%", strUserInput);

**And your sql should be:**

```
SELECT * FROM `sometable`WHERE `name` LIKE @nameORDER BY `id` ASCLIMIT 1,10
```


---

Original Source: https://www.mindstick.com/forum/12819/parameterized-string-and-wildcards-in-mysql

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.