如何执行带参数的SQL查询（使用LIKE与@变量）？LIKE语法与%位置咨询

Hey there! Let’s tackle these two SQL questions one by one—they’re super common, so I’ll use concrete examples to make it clear.

When working with @variables (common in SQL Server, Azure SQL, etc.), the key is to keep your query parameterized (to avoid SQL injection) while integrating the LIKE operator. Here’s how to do it right:

Example for SQL Server: #

First, declare your variable, then use it in the LIKE clause by combining it with wildcard characters (%) using string concatenation or the CONCAT function:

-- Declare and set your parameter value
DECLARE @SearchKeyword NVARCHAR(50) = 'doe';

-- Option 1: Using string concatenation
SELECT FirstName, LastName, Email
FROM Users
WHERE LastName LIKE '%' + @SearchKeyword + '%';

-- Option 2: Using CONCAT (cleaner, works with NULL values)
SELECT FirstName, LastName, Email
FROM Users
WHERE LastName LIKE CONCAT('%', @SearchKeyword, '%');

If you’re using this in an application (like C#/Java/Python), you’d pass the @SearchKeyword as a parameter to your command object instead of hardcoding it—this is critical for security.

The position of the % wildcard depends on what you want to match, but always use parameterized queries when dealing with user input (never directly insert user input into your SQL string—this is a huge SQL injection risk).

Here’s how the wildcard positions work:

• Match strings ending with the input: Place % at the start of the pattern

  -- Matches "JohnDoe", "JaneDoe", etc.
  SELECT * FROM Users WHERE LastName LIKE '%' + @UserInput + '';
  

• Match strings starting with the input: Place % at the end of the pattern

  -- Matches "DoeJohn", "DoeJane", etc.
  SELECT * FROM Users WHERE LastName LIKE '' + @UserInput + '%';
  

• Match strings containing the input anywhere: Place % on both sides

  -- Matches "JohnDoe", "DoeJane", "JohnDoeSmith", etc.
  SELECT * FROM Users WHERE LastName LIKE '%' + @UserInput + '%';
  

Critical Note: #

Avoid this dangerous practice at all costs:

-- ❌ RISKY: Directly concatenates user input (SQL injection vulnerability!)
SELECT * FROM Users WHERE LastName LIKE '%' + 'UserInputFromForm' + '%';

Always use parameterized variables (like @UserInput) to separate user data from your SQL logic.

内容的提问来源于stack exchange，提问作者Sema