# Python MySQLdb WHERE SQL LIKE

I have recently started to learn Python and MySQL for web purposes and I have run into a following problem :

I want to pull out from a mysql database one record that contains any text that I enter in param section, howerver I am running into following problem when making a query:

``````traceback (most recent call last):
File "/Users/Strielok/Desktop/test.py", line 13, in <module>
c.execute("SELECT * FROM data WHERE params LIKE ('%s%') LIMIT 1"  % (param))
TypeError: not enough arguments for format string
``````

Here is my code:

``````import MySQLdb

db = MySQLdb.connect (host = "localhost",
user = "root",
passwd = "root",
db = "test")
param = "Test"

par = param

c = db.cursor()

c.execute("SELECT * FROM data WHERE params LIKE ('%s%') LIMIT 1"  % (param))

data = c.fetchall()
print data

c.close()
``````

Directly inserting the data into the SQL string is not the best way to do this, as it is prone to SQL injection. You should change it to this:

`c.execute("SELECT * FROM data WHERE params LIKE %s LIMIT 1", ("%" + param + "%",))`

• Oops, you're totally correct @univerio. Deleted my answer, yours is better. Jun 5 '12 at 20:07
• thanks, your solution was the best, I like this section " ("%" + param + "%",)" Jun 7 '12 at 12:25

A better aproach (and safer), instead to use a string as `"%" + param + "%"` would be to escape `%` char in template string with another `%` (so, `%%`), so it'll be:

`c.execute("SELECT * FROM data WHERE params LIKE '%%%s%%' LIMIT 1", (param,))`

Your not using a proper parameter. Python is expecting another qualifier in this area `('%s%___')` in order to do a string substitution. This is also vulnerable code. The proper way to do this would look more like:

`c.execute("SELECT * FROM data WHERE params LIKE '%%s%' LIMIT 1",(param,))`

• I don't think this will result in the same query. The final string will a LIKE clause of %param%, rather than param%, as @univerio intends. Jun 5 '12 at 19:33
{"ft_lang_label":"__label__en","ft_lang_prob":0.7795745,"math_prob":0.74627835,"size":800,"snap":"2021-31-2021-39","text_gpt3_token_len":203,"char_repetition_ratio":0.07788945,"word_repetition_ratio":0.12307692,"special_character_ratio":0.27625,"punctuation_ratio":0.12258065,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.95443684,"pos_list":[0],"im_url_duplicate_count":[null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2021-09-18T00:09:40Z\",\"WARC-Record-ID\":\"<urn:uuid:863f7bdd-6527-4fd2-802a-f1edbcdacfc5>\",\"Content-Length\":\"186314\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:8bb04c53-b387-481d-9722-b2660d5b622a>\",\"WARC-Concurrent-To\":\"<urn:uuid:ea0e9dbe-7fef-40f9-bd20-b52e69835f46>\",\"WARC-IP-Address\":\"151.101.65.69\",\"WARC-Target-URI\":\"https://stackoverflow.com/questions/10903497/python-mysqldb-where-sql-like/62899052\",\"WARC-Payload-Digest\":\"sha1:U4CPZKMZ7MQX5IJKGQEPMZJ22DVKMS3N\",\"WARC-Block-Digest\":\"sha1:UEOSDBJHCPI3M272XSTL4GF3L6U2DSAY\",\"WARC-Identified-Payload-Type\":\"text/html\",\"warc_filename\":\"/cc_download/warc_2021/CC-MAIN-2021-39/CC-MAIN-2021-39_segments_1631780055808.78_warc_CC-MAIN-20210917212307-20210918002307-00652.warc.gz\"}"}