In SQLite3, how can I do SQL-escaping in a LIKE clause?

Question

I'd like to run a LIKE query in sqlite3 with the user's input safely escaped. Basically, I want to do something like this:

char* query = "SELECT * FROM table WHERE LOWER(notes) LIKE '%?%'";
sqlite3_stmt* statement;
sqlite3_prepare_v2( database, query, -1, &statement, NULL );

But the ? is not honored when inside the LIKE expression. Anyone know how to do this?

Answer 1

char* query = "SELECT * FROM table WHERE LOWER(notes) LIKE '%' || ? || '%'";

But I recommend you look into using FTS3 for full text searching, because your queries will run hundreds of times faster than using brute-force LIKE queries.