WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to use a LIKE %text% statement while still using the WordPress $wpdb class to sanitize and prepare input.

SELECT column_1 from `prefix_my_table` WHERE column_2 LIKE '%something%';

I've tried something like this to no avail:

$wpdb->prepare( "SELECT column_1 from `{$wpdb->base_prefix}my_table` WHERE column_2 LIKE %s;", like_escape($number_to_put_in_like));

How do you properly prepare a %LIKE% SQL statement using the WordPress database class?

share|improve this question
up vote 21 down vote accepted

The $wpdb->esc_like function exists in WordPress because the regular database escaping does not escape % and _ characters. This means you can add them in your arguments to wpdb::prepare() without problem. This is also what I see in the core WordPress code:

$wpdb->prepare(" AND $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE %s", '%' . $this->role . '%');

So your code would look like:

$wpdb->prepare( "SELECT column_1 from `{$wpdb->base_prefix}my_table` WHERE column_2 LIKE %s;", '%' . $wpdb->esc_like($number_to_put_in_like) . '%');

You can also add %% in your query to get a literal % (wpdb::prepare() uses vsprintf() in the background, which has this syntax), but remember that your string will not be quoted, you must add the quotes yourself (which is not what you usually have to do in wpdb::prepare().

share|improve this answer
what are the {} for ? – Francisco Corrales Morales Aug 20 '14 at 22:39
@FranciscoCorralesMorales: To indicate that everything inside it should be considered a variable expression, otherwise it would only see $wpdb, and ignore the ->prefix after it. – Jan Fabry Aug 21 '14 at 15:14

You need to double percent so they are no treated like fragment markers by wpdb->prepare():

$wpdb->prepare( "SELECT column_1 from `{$wpdb->base_prefix}my_table` WHERE column_2 LIKE %%%s%%;", like_escape( $number_to_put_in_like));

PS not sure this is best/only way to do it.

share|improve this answer
Remember that you must add the quotes around the string yourself, because wpdb::prepare will only add them for a %s that is not preceded by an %. The final part of your query should be WHERE column_2 LIKE '%%%s%%'. – Jan Fabry Feb 8 '11 at 9:39

This is one way to do it that I've checked and it works:

$search_text = "%" . $_GET['some_text'] . "%";

$user_count = $wpdb->get_var( 
        "SELECT COUNT(*) FROM mix_library WHERE ml_setting_name LIKE %s", 

Replace variables to suit your needs.

share|improve this answer
You should escape % characters (by using like_escape(). See: codex.wordpress.org/Class_Reference/… – Stephen Harris Oct 25 '12 at 9:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.