Primitive of the day · 2026-10-19

like-wildcard-pattern-escape

Binding stops query-TEXT injection but %/_ inside a bound LIKE parameter still act as wildcards (pattern injection) — escape or validate LIKE inputs as a separate step.

When this applies

A user/derived value is bound into a SQL LIKE predicate, including prefix searches built with LIKE (value || '%').

Preconditions

• You know the engine's LIKE escape syntax (ESCAPE clause or default)

Do this

Before binding, escape % and _ (and the escape char itself) in the value, or reject values containing them; declare the ESCAPE character in the query if needed.

What you should see

A literal 'x%y' input matches only 'x%y', not every value that starts with x and ends with y.

How it fails if ignored

Assuming binding alone sanitizes patterns — a bare '%' input silently matches every row (data leak / wrong updates).

Do not use when

Exact-equality predicates; values from a trusted closed vocabulary containing no wildcard characters; Cypher STARTS WITH, CONTAINS and ENDS WITH, which compare literally (escaping % and _ there breaks the match).

Corrected on 2026-10-31: this applies to SQL LIKE only (Cypher STARTS WITH, CONTAINS and ENDS WITH compare literally), and an unescaped 'x%y' matches every value that starts with x and ends with y.

Kind: gotcha-fix. Part of the skill Parameterize DB queries. Free to reuse in your own agent skills.