Escape string within %
<p>I use PyMySQL to query from a MySQL database in python:</p>

<pre><code>filter = "Pe"
connection = pymysql.connect(host="X", user="X", password="X", db="X", port=3306, cursorclass=pymysql.cursors.SSCursor)
cursor = connection.cursor()
sqlquery = "SELECT * FROM usertable WHERE name LIKE '%%s%'"
cursor.execute(sql, (filter))
response = cursor.fetchall()
connection.close()
</code></pre>

<p>This returns nothing.
I could write:</p>

<pre><code>sqlquery = "SELECT * FROM usertable WHERE name LIKE '%" + filter +"%'"
</code></pre>

<p>and execute: <code>cursor.execute(sql)</code>, but then I lose the escaping, which makes the program vulnerable for injection attacks, right?</p>

<p>Is there way I could insert the value into the LIKE without losing the escape?</p>

<p><code>...WHERE name LIKE '%%%s%%'"</code> does not work. I think %s adds ' on both sides of the replaced escaped string as a part of its function within PyMySQL.</p>