Sql statement with like from variable
Question: I'm executing this code in python

    
    
    from sqlite3 import dbapi2 as sqlite
    
    con = sqlite.connect("db.sqlite")
    cur = con.cursor()
    surname = "'%atton%'"
    cur.execute("select id from singers where surname like :surname", locals())
    cur.close()
    con.close()
    

After this code `cur.rowcount == -1` but Patton is in the database.

Is my SQL statement bad?

thank you


Answer: The DB-API parameterization you use (which you _should_ use, don't change
that) means the surname will automatically be quoted or escaped appropriately.
You should remove the inner set of quotes from your `surname` string.

    
    
    surname = "%atton%"
    cur.execute("select id from singers where surname like :surname",
        dict(surname=surname))
    

