title: C MySQL API prepared statement restrictions
body: <p>I am trying to build a SQL query in a CGI script written in C. The user passes some sort of parameter when querying the page, and the script needs to query for:</p>
  
  <pre><code>SELECT `name`, `address`, `phone_number` FROM `restaurants` WHERE `name` LIKE '%{parameter}%'
  </code></pre>
  
  <p>I obviously can't just replace {parameter} with %s and sprintf into a string because of escaping and security issues.</p>
  
  <p>Therefore I've constructed a prepared statement:</p>
  
  <pre><code>const char * statement = "SELECT `name`, `address`, `phone_number` FROM `restaurants` WHERE `name` LIKE '%?%'";
  </code></pre>
  
  <p>What ends up happening is that my question mark does not get parsed and the binding fails. When I change the end of the statement to "<code>name</code> LIKE ?", this works perfectly, except I lose the results containing the term rather than equaling it, which is bad.</p>
  
  <p>Is it possible to get around this and still properly and securely construct SQL statements with LIKE's and parameters inside strings?</p>
  
  <p>Thanks!</p>