sql code not work

[cryptid]

sql code not work

Code: Pascal  [Select][+][-]

1. procedure TForm1.Edit1KeyPress(Sender: TObject; var Key: char);
2. begin
3.   with SQLQuery1 do
4.     begin
5.        SQL.Clear;
6.        SQL.Add('select * from log WHERE user LIKE"'+Edit1.Text+'%"');
7.        Active:=True;
8.     end;
9. end;

[Edited to add code tags: Please see How to use the Forum.]

[ttomas]

I don't see SPACE after LIKE

[MarkMLl]

I don't see SPACE after LIKE

Well spotted, probably needs ' %'

MarkMLl

[egsuh]

Using format can be of help.

SQL.Text:= Format('select * from log where user like ''%s%%'';',  [Edit1.Text]);

%s is replaced by Edit1.Text. %% is read as %.

[PierceNg]

SQL string construction is vulnerable to SQL injection. Should use parameterization:

Code: Pascal  [Select][+][-]

1. SQL.Text:= 'select * from log where user like :PATTERN;';
2. Params.ParamsByName('PATTERN').AsString := Edit1.Text;

See https://bobby-tables.com/.

[flori]

Code: Pascal  [Select][+][-]

1. SQLQuery1.Active:=false;
2. SQLQuery1.SQL.Clear;
3. SQLQuery1.SQL.Append('select * from log WHERE user LIKE '''+edit1.Text+'%''');
4. SQLQuery1.Active:=true