title: (How) can I use "LIKE" in SQL queries with MyBatis safely and DB-agnostic?
body: <p>In <a href="http://www.mybatis.org/" rel="noreferrer">MyBatis</a>, you mark the places where parameters should be inserted into your SQL like so:</p>
  
  <blockquote>
    <p>SELECT * FROM Person WHERE id = <strong>#{id}</strong></p>
  </blockquote>
  
  <p>This syntax activates proper escaping etc to avoid, among other things, SQL injection attacks. If you have trusted input and want to skip escaping, you can insert the parameters verbatim:</p>
  
  <blockquote>
    <p>SELECT * FROM <strong>{tableName}</strong> WHERE id = #{id}</p>
  </blockquote>
  
  <p>Now, I want to do a LIKE search on unsafe input, so what I want to do is this:</p>
  
  <blockquote>
    <p>SELECT * FROM Person WHERE name LIKE <strong>#{beginningOfName} || '%'</strong></p>
  </blockquote>
  
  <p><em>Unfortunately</em>, however, important DB servers <a href="http://troels.arvin.dk/db/rdbms/#functions-concat" rel="noreferrer">don't support the <code>||</code> syntax for concatenation</a>:</p>
  
  <blockquote>
    <p>MSSQL - Breaks the standard by using the '+' operator instead of '||'.</p>
    
    <p>...</p>
    
    <p>MySQL - Badly breaks the standard by redefining || to mean OR. </p>
  </blockquote>
  
  <p>So, I could do either</p>
  
  <blockquote>
    <p>SELECT * FROM Person WHERE name LIKE <strong>CONCAT(#{beginningOfName}, '%')</strong></p>
  </blockquote>
  
  <p>and be confined to, in this case, MySQL, or I could do</p>
  
  <blockquote>
    <p>SELECT * FROM Person WHERE name LIKE <strong>'{beginningOfName}%'</strong></p>
  </blockquote>
  
  <p>and would have to sanitize input myself.</p>
  
  <p>Is there a more elegant solution?</p>