t-sql 4.7.1__tar.gz → 4.8.0__tar.gz

t_sql-4.7.1/README.md → t_sql-4.8.0/PKG-INFO

@@ -1,3 +1,13 @@
+Metadata-Version: 2.4
+Name: t-sql
+Version: 4.8.0
+Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
+Project-URL: Homepage, https://github.com/nhumrich/t-sql
+License-File: LICENSE
+Requires-Python: >=3.14
+Requires-Dist: alembic>=1.17.0
+Description-Content-Type: text/markdown
+
 # t-sql
 
 A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP 750).
@@ -105,6 +115,45 @@ sql, params = tsql.render(t"UPDATE users SET {values:as_set} WHERE id='abc123'")
 # ('UPDATE users SET name = ?, email = ? WHERE id='abc123'', ['joe', 'joe@example.com'])
 ```
 
+#### LIKE Pattern Matching
+
+**Safe pattern matching with automatic wildcard escaping**:
+
+```python
+# Contains search (%value%)
+search = "john"
+sql, params = tsql.render(t"SELECT * FROM users WHERE name ILIKE {search:%like%}")
+# ('SELECT * FROM users WHERE name ILIKE ? ESCAPE '\\'', ['%john%'])
+
+# Prefix search (value% - starts with)
+prefix = "admin"
+sql, params = tsql.render(t"SELECT * FROM users WHERE username LIKE {prefix:like%}")
+# ('SELECT * FROM users WHERE username LIKE ? ESCAPE '\\'', ['admin%'])
+
+# Suffix search (%value - ends with)
+domain = "@gmail.com"
+sql, params = tsql.render(t"SELECT * FROM users WHERE email LIKE {domain:%like}")
+# ('SELECT * FROM users WHERE email LIKE ? ESCAPE '\\'', ['%@gmail.com'])
+```
+
+**Security**: All LIKE format specs automatically escape `%`, `_`, and `\` wildcards in user input to prevent injection attacks:
+
+# Wildcards in data are escaped
+search = "50%_discount"
+sql, params = tsql.render(t"SELECT * FROM products WHERE name LIKE {search:%like%}")
+# ('SELECT * FROM products WHERE name LIKE ? ESCAPE '\\'', ['%50\\%\\_discount%'])
+# Matches the literal string "50%_discount", not "50X" or "50Xdiscount"
+```
+
+**For controlled values where you WANT wildcards**, build the pattern manually without format specs:
+
+```python
+# Developer-controlled pattern (wildcards intentional)
+pattern = f"%{category}%"
+sql, params = tsql.render(t"SELECT * FROM products WHERE tags LIKE {pattern}")
+# No escaping - % and _ work as wildcards
+```
+
 #### Tuples for IN clauses
 
 Use tuples to expand lists of values for SQL IN clauses:

t_sql-4.7.1/PKG-INFO → t_sql-4.8.0/README.md

@@ -1,13 +1,3 @@
-Metadata-Version: 2.4
-Name: t-sql
-Version: 4.7.1
-Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
-Project-URL: Homepage, https://github.com/nhumrich/t-sql
-License-File: LICENSE
-Requires-Python: >=3.14
-Requires-Dist: alembic>=1.17.0
-Description-Content-Type: text/markdown
-
 # t-sql
 
 A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP 750).
@@ -115,6 +105,45 @@ sql, params = tsql.render(t"UPDATE users SET {values:as_set} WHERE id='abc123'")
 # ('UPDATE users SET name = ?, email = ? WHERE id='abc123'', ['joe', 'joe@example.com'])
 ```
 
+#### LIKE Pattern Matching
+
+**Safe pattern matching with automatic wildcard escaping**:
+
+```python
+# Contains search (%value%)
+search = "john"
+sql, params = tsql.render(t"SELECT * FROM users WHERE name ILIKE {search:%like%}")
+# ('SELECT * FROM users WHERE name ILIKE ? ESCAPE '\\'', ['%john%'])
+
+# Prefix search (value% - starts with)
+prefix = "admin"
+sql, params = tsql.render(t"SELECT * FROM users WHERE username LIKE {prefix:like%}")
+# ('SELECT * FROM users WHERE username LIKE ? ESCAPE '\\'', ['admin%'])
+
+# Suffix search (%value - ends with)
+domain = "@gmail.com"
+sql, params = tsql.render(t"SELECT * FROM users WHERE email LIKE {domain:%like}")
+# ('SELECT * FROM users WHERE email LIKE ? ESCAPE '\\'', ['%@gmail.com'])
+```
+
+**Security**: All LIKE format specs automatically escape `%`, `_`, and `\` wildcards in user input to prevent injection attacks:
+
+# Wildcards in data are escaped
+search = "50%_discount"
+sql, params = tsql.render(t"SELECT * FROM products WHERE name LIKE {search:%like%}")
+# ('SELECT * FROM products WHERE name LIKE ? ESCAPE '\\'', ['%50\\%\\_discount%'])
+# Matches the literal string "50%_discount", not "50X" or "50Xdiscount"
+```
+
+**For controlled values where you WANT wildcards**, build the pattern manually without format specs:
+
+```python
+# Developer-controlled pattern (wildcards intentional)
+pattern = f"%{category}%"
+sql, params = tsql.render(t"SELECT * FROM products WHERE tags LIKE {pattern}")
+# No escaping - % and _ work as wildcards
+```
+
 #### Tuples for IN clauses
 
 Use tuples to expand lists of values for SQL IN clauses:

{t_sql-4.7.1 → t_sql-4.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "t-sql"
-version = "4.7.1"
+version = "4.8.0"
 description = "Safe SQL. SQL queries for python t-strings (PEP 750)"
 readme = "README.md"
 requires-python = ">=3.14"

{t_sql-4.7.1 → t_sql-4.8.0}/tests/test_asyncpg_integration.py

@@ -268,4 +268,105 @@ async def test_datetime_comparison_with_asyncpg(conn):
     # Should find User2 and User3 (created within last 15 minutes)
     assert len(rows) == 2
     names = sorted([row['name'] for row in rows])
-    assert names == ['User2', 'User3']
+    assert names == ['User2', 'User3']
+
+
+async def test_like_pattern_format_specs_with_postgres(conn):
+    """Test LIKE pattern format specs with PostgreSQL"""
+    # Insert test data with special characters
+    await conn.execute(
+        "INSERT INTO test_users (name) VALUES ($1), ($2), ($3), ($4)",
+        'john_doe', 'john%smith', 'alice', 'admin_50%'
+    )
+
+    # Test contains pattern (%like%)
+    search = "john"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {search:%like%} ORDER BY name",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    assert "ESCAPE '\\'" in sql
+    assert params == ['%john%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match both john_doe and john%smith
+    assert len(rows) == 2
+    names = sorted([row['name'] for row in rows])
+    assert names == ['john%smith', 'john_doe']
+
+    # Test prefix pattern (like%)
+    prefix = "admin"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {prefix:like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    assert params == ['admin%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'admin_50%'
+
+    # Test wildcard escaping - searching for literal underscore
+    search = "john_"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {search:%like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    # Should escape the underscore
+    assert params == ['%john\\_%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match only john_doe (literal underscore after "john")
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'john_doe'
+
+    # Test wildcard escaping - searching for literal percent
+    search = "50%"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {search:%like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    # Should escape the percent
+    assert params == ['%50\\%%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'admin_50%'
+
+    # Test suffix pattern (%like)
+    suffix = "_doe"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {suffix:%like}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    # Underscore should be escaped
+    assert params == ['%\\_doe']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match john_doe
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'john_doe'
+
+    # Test ILIKE (case-insensitive) works too
+    search = "JOHN"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name ILIKE {search:%like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match both john_doe and john%smith (case-insensitive)
+    assert len(rows) == 2

t_sql-4.8.0/tests/test_like_patterns.py

@@ -0,0 +1,282 @@
+"""Tests for LIKE pattern format specs."""
+
+import pytest
+import tsql
+from tsql.styles import QMARK, NUMERIC, NAMED, FORMAT, PYFORMAT, NUMERIC_DOLLAR
+
+
+class TestLikePatternBasics:
+    """Test basic LIKE pattern functionality."""
+
+    def test_like_contains_pattern(self):
+        """Test %like% format spec produces contains pattern."""
+        search = "john"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}")
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\'"
+        assert params == ['%john%']
+
+    def test_like_prefix_pattern(self):
+        """Test like% format spec produces starts-with pattern."""
+        search = "admin"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:like%}")
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\'"
+        assert params == ['admin%']
+
+    def test_like_suffix_pattern(self):
+        """Test %like format spec produces ends-with pattern."""
+        search = ".com"
+        sql, params = tsql.render(t"SELECT * FROM emails WHERE address LIKE {search:%like}")
+
+        assert sql == "SELECT * FROM emails WHERE address LIKE ? ESCAPE '\\'"
+        assert params == ['%.com']
+
+
+class TestWildcardEscaping:
+    """Test that wildcards are properly escaped."""
+
+    def test_escapes_percent_wildcard(self):
+        """Test that % is escaped to \\%."""
+        search = "50%"
+        sql, params = tsql.render(t"SELECT * FROM products WHERE discount LIKE {search:%like%}")
+
+        assert params == ['%50\\%%']
+
+    def test_escapes_underscore_wildcard(self):
+        """Test that _ is escaped to \\_."""
+        search = "user_name"
+        sql, params = tsql.render(t"SELECT * FROM logs WHERE field LIKE {search:%like%}")
+
+        assert params == ['%user\\_name%']
+
+    def test_escapes_backslash(self):
+        """Test that \\ is escaped to \\\\."""
+        search = "C:\\Users"
+        sql, params = tsql.render(t"SELECT * FROM paths WHERE path LIKE {search:%like%}")
+
+        assert params == ['%C:\\\\Users%']
+
+    def test_escapes_all_wildcards_together(self):
+        """Test multiple wildcards in one value."""
+        search = "test_50%\\path"
+        sql, params = tsql.render(t"SELECT * FROM mixed WHERE value LIKE {search:%like%}")
+
+        assert params == ['%test\\_50\\%\\\\path%']
+
+    def test_empty_string(self):
+        """Test empty string produces just the pattern."""
+        search = ""
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}")
+
+        assert params == ['%%']
+
+
+class TestSecurityScenarios:
+    """Test that injection attempts are neutralized."""
+
+    def test_prevents_wildcard_injection_contains(self):
+        """Test that user can't inject wildcards to expand search."""
+        malicious = "%admin"  # Trying to search for anything containing 'admin'
+        sql, params = tsql.render(t"SELECT * FROM users WHERE username LIKE {malicious:like%}")
+
+        # Should match literally '%admin' followed by anything
+        assert params == ['\\%admin%']
+
+    def test_prevents_full_table_scan(self):
+        """Test that % alone doesn't create %%."""
+        malicious = "%"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {malicious:%like%}")
+
+        # Should match literally '%' anywhere
+        assert params == ['%\\%%']
+
+    def test_prevents_sql_injection_attempt(self):
+        """Test that SQL injection attempts are treated as literals."""
+        malicious = "%'; DROP TABLE users; --"
+        sql, params = tsql.render(t"SELECT * FROM logs WHERE message LIKE {malicious:%like%}")
+
+        # Everything is escaped and parameterized
+        assert "DROP TABLE" in params[0]  # Present in parameter value
+        assert "DROP TABLE" not in sql  # Not in SQL itself
+        assert params == ["%\\%'; DROP TABLE users; --%"]
+
+
+class TestTypeHandling:
+    """Test type conversion and None handling."""
+
+    def test_converts_int_to_string(self):
+        """Test that integers are converted to strings."""
+        number = 42
+        sql, params = tsql.render(t"SELECT * FROM products WHERE code LIKE {number:%like%}")
+
+        assert params == ['%42%']
+
+    def test_converts_float_to_string(self):
+        """Test that floats are converted to strings."""
+        number = 3.14
+        sql, params = tsql.render(t"SELECT * FROM values WHERE val LIKE {number:%like%}")
+
+        assert params == ['%3.14%']
+
+    def test_none_raises_error_contains(self):
+        """Test that None raises ValueError for %like%."""
+        value = None
+        with pytest.raises(ValueError, match="LIKE pattern value cannot be None"):
+            tsql.render(t"SELECT * FROM users WHERE name LIKE {value:%like%}")
+
+    def test_none_raises_error_prefix(self):
+        """Test that None raises ValueError for like%."""
+        value = None
+        with pytest.raises(ValueError, match="LIKE pattern value cannot be None"):
+            tsql.render(t"SELECT * FROM users WHERE name LIKE {value:like%}")
+
+    def test_none_raises_error_suffix(self):
+        """Test that None raises ValueError for %like."""
+        value = None
+        with pytest.raises(ValueError, match="LIKE pattern value cannot be None"):
+            tsql.render(t"SELECT * FROM users WHERE name LIKE {value:%like}")
+
+
+class TestMultipleParameters:
+    """Test queries with multiple LIKE clauses."""
+
+    def test_multiple_like_patterns_in_one_query(self):
+        """Test that multiple LIKE patterns work correctly."""
+        name = "john"
+        email = "gmail"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {name:%like%} OR email LIKE {email:%like}")
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\' OR email LIKE ? ESCAPE '\\'"
+        assert params == ['%john%', '%gmail']
+
+    def test_mixed_like_patterns(self):
+        """Test different pattern types in one query."""
+        prefix = "admin"
+        suffix = ".com"
+        contains = "test"
+        sql, params = tsql.render(t"""
+            SELECT * FROM data
+            WHERE username LIKE {prefix:like%}
+            AND email LIKE {suffix:%like}
+            AND description LIKE {contains:%like%}
+        """)
+
+        assert params == ['admin%', '%.com', '%test%']
+        assert sql.count("ESCAPE '\\'") == 3
+
+
+class TestParameterStyles:
+    """Test that LIKE patterns work with different parameter styles."""
+
+    def test_qmark_style(self):
+        """Test with ? placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", QMARK)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_numeric_style(self):
+        """Test with :1, :2, ... placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", NUMERIC)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE :1 ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_numeric_dollar_style(self):
+        """Test with $1, $2, ... placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", NUMERIC_DOLLAR)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE $1 ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_named_style(self):
+        """Test with :name placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", NAMED)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE :search ESCAPE '\\'"
+        assert params == {'search': '%test%'}
+
+    def test_format_style(self):
+        """Test with %s placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", FORMAT)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE %s ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_pyformat_style(self):
+        """Test with %(name)s placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", PYFORMAT)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE %(search)s ESCAPE '\\'"
+        assert params == {'search': '%test%'}
+
+
+class TestCaseSensitivity:
+    """Test that LIKE vs ILIKE is orthogonal to pattern specs."""
+
+    def test_like_case_sensitive(self):
+        """Test LIKE with pattern."""
+        search = "John"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}")
+
+        assert "LIKE" in sql
+        assert "ILIKE" not in sql
+        assert params == ['%John%']
+
+    def test_ilike_case_insensitive(self):
+        """Test ILIKE with pattern."""
+        search = "John"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name ILIKE {search:%like%}")
+
+        assert "ILIKE" in sql
+        assert params == ['%John%']
+
+
+class TestRealWorldScenarios:
+    """Test realistic usage patterns."""
+
+    def test_user_search_box(self):
+        """Test typical user search functionality."""
+        user_input = "john doe"
+        sql, params = tsql.render(t"""
+            SELECT id, name, email
+            FROM users
+            WHERE name ILIKE {user_input:%like%}
+            ORDER BY name
+        """)
+
+        assert params == ['%john doe%']
+
+    def test_email_domain_filter(self):
+        """Test filtering by email domain."""
+        domain = "@gmail.com"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE email LIKE {domain:%like}")
+
+        assert params == ['%@gmail.com']
+
+    def test_username_prefix_search(self):
+        """Test username autocomplete."""
+        prefix = "adm"
+        sql, params = tsql.render(t"""
+            SELECT username
+            FROM users
+            WHERE username LIKE {prefix:like%}
+            LIMIT 10
+        """)
+
+        assert params == ['adm%']
+
+    def test_log_message_search_with_special_chars(self):
+        """Test searching logs that might contain special characters."""
+        search = "Error: 50% complete [user_123]"
+        sql, params = tsql.render(t"SELECT * FROM logs WHERE message LIKE {search:%like%}")
+
+        # All special chars should be escaped
+        assert params == ['%Error: 50\\% complete [user\\_123]%']

{t_sql-4.7.1 → t_sql-4.8.0}/tests/test_sqlite_integration.py

@@ -349,3 +349,83 @@ async def test_query_builder_select(conn):
     rows = await cursor.fetchall()
 
     assert len(rows) == 1
+
+
+async def test_like_pattern_format_specs(conn):
+    """Test LIKE pattern format specs with SQLite"""
+    # Insert test data with special characters
+    await conn.execute(
+        "INSERT INTO test_users (name) VALUES (?), (?), (?), (?)",
+        ('john_doe', 'john%smith', 'alice', 'admin_50%')
+    )
+    await conn.commit()
+
+    # Test contains pattern (%like%)
+    search = "john"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {search:%like%} ORDER BY name")
+
+    assert "ESCAPE '\\'" in sql
+    assert params == ['%john%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match both john_doe and john%smith
+    assert len(rows) == 2
+    assert rows[0][0] == 'john%smith'
+    assert rows[1][0] == 'john_doe'
+
+    # Test prefix pattern (like%)
+    prefix = "admin"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {prefix:like%}")
+
+    assert params == ['admin%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0][0] == 'admin_50%'
+
+    # Test wildcard escaping - searching for literal underscore
+    search = "john_"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {search:%like%}")
+
+    # Should escape the underscore
+    assert params == ['%john\\_%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match only john_doe (literal underscore after "john")
+    assert len(rows) == 1
+    assert rows[0][0] == 'john_doe'
+
+    # Test wildcard escaping - searching for literal percent
+    search = "50%"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {search:%like%}")
+
+    # Should escape the percent
+    assert params == ['%50\\%%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0][0] == 'admin_50%'
+
+    # Test suffix pattern (%like)
+    suffix = "_doe"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {suffix:%like}")
+
+    # Underscore should be escaped
+    assert params == ['%\\_doe']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match john_doe
+    assert len(rows) == 1
+    assert rows[0][0] == 'john_doe'

{t_sql-4.7.1 → t_sql-4.8.0}/tsql/__init__.py

@@ -24,6 +24,11 @@ def set_style(style: type[ParamStyle]):
     default_style = style
 
 
+def _escape_like(value: str) -> str:
+    # Order matters: escape backslash first to avoid double-escaping
+    return value.replace('\\', '\\\\').replace('%', '\\%').replace('_', '\\_')
+
+
 class Parameter:
     _expression: str
     _value: Any
@@ -141,6 +146,28 @@ class TSQL:
                     return as_values(value)._sql_parts
                 case 'as_set', dict():
                     return as_set(value)._sql_parts
+                case fmt_spec, _ if fmt_spec in ('%like%', 'like%', '%like'):  # LIKE patterns
+                    if value is None:
+                        raise ValueError(
+                            f"LIKE pattern value cannot be None for {{value:{fmt_spec}}}. "
+                            f"Use a non-None value or handle None before the query."
+                        )
+                    str_value = str(value)
+                    escaped = _escape_like(str_value)
+
+                    # Apply pattern based on format spec
+                    if fmt_spec == '%like%':
+                        wrapped = f"%{escaped}%"
+                        pattern_type = "contains"
+                    elif fmt_spec == 'like%':
+                        wrapped = f"{escaped}%"
+                        pattern_type = "prefix"
+                    else:  # '%like'
+                        wrapped = f"%{escaped}"
+                        pattern_type = "suffix"
+
+                    logger.debug("LIKE %s pattern: %r -> %r (escaped: %r)", pattern_type, value, wrapped, escaped)
+                    return [Parameter(val.expression, wrapped), " ESCAPE '\\'"]
                 case '', TSQL():
                     return val.value._sql_parts
                 case "", Template():