How to use LIKE operator with PreparedStatement

Question

Hi, I need to execute a query with the LIKE operator, but using a PreparedStatement. Can I do this, and if so what must my SQL look like with the wildcard characters '%' or '_'?
normal PS example: conn.prepareStatement("select * from mytable where name like ?");
If I try: conn.prepareStatement("select * from mytable where name like ?%");
I get: ORA-00911: invalid character
If I try: conn.prepareStatement("select * from mytable where name like '?%'");
I get: ORA-01006: bind variable does not exist
I must use a PreparedStatement, as my variable may contain illegal characters (like '), and using PreparedStatement.setString(1, var) will automatically escape it for me.
I could also use a normal Statement, but I need to escape my var ... is there a utility that will safely escape a String for an Oracle VARCHAR2??
Thanks in advance,
Stu Miller

Answer 1

Hmm, it seems you are right...
when my variable contains a '%' symbol, the PreparedStatement will NOT escape it, and thus it is treated like a wildcard. Therefore, I can just do
pstmt.setString(1, var+"%");
But, that may return more results than I'm asking for, as when 'var' contains a '%' symbol it is taken as a wildcard too.
I need each character in my variable to be taken literally, and only add a wildcard at the end. Basically, I need a STARTSWITH operator ;-)
It seems to me that escaping the sensitive characters in a String (which will differ depending on which operator is used), should be possible. I could write this, but I was hoping Oracle had already done it for me in some utility class.