t-sql 4.7.1__tar.gz → 4.9.0__tar.gz

t_sql-4.7.1/README.md → t_sql-4.9.0/PKG-INFO

@@ -1,3 +1,13 @@
+Metadata-Version: 2.4
+Name: t-sql
+Version: 4.9.0
+Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
+Project-URL: Homepage, https://github.com/nhumrich/t-sql
+License-File: LICENSE
+Requires-Python: >=3.14
+Requires-Dist: alembic>=1.17.0
+Description-Content-Type: text/markdown
+
 # t-sql
 
 A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP 750).
@@ -105,6 +115,45 @@ sql, params = tsql.render(t"UPDATE users SET {values:as_set} WHERE id='abc123'")
 # ('UPDATE users SET name = ?, email = ? WHERE id='abc123'', ['joe', 'joe@example.com'])
 ```
 
+#### LIKE Pattern Matching
+
+**Safe pattern matching with automatic wildcard escaping**:
+
+```python
+# Contains search (%value%)
+search = "john"
+sql, params = tsql.render(t"SELECT * FROM users WHERE name ILIKE {search:%like%}")
+# ('SELECT * FROM users WHERE name ILIKE ? ESCAPE '\\'', ['%john%'])
+
+# Prefix search (value% - starts with)
+prefix = "admin"
+sql, params = tsql.render(t"SELECT * FROM users WHERE username LIKE {prefix:like%}")
+# ('SELECT * FROM users WHERE username LIKE ? ESCAPE '\\'', ['admin%'])
+
+# Suffix search (%value - ends with)
+domain = "@gmail.com"
+sql, params = tsql.render(t"SELECT * FROM users WHERE email LIKE {domain:%like}")
+# ('SELECT * FROM users WHERE email LIKE ? ESCAPE '\\'', ['%@gmail.com'])
+```
+
+**Security**: All LIKE format specs automatically escape `%`, `_`, and `\` wildcards in user input to prevent injection attacks:
+
+# Wildcards in data are escaped
+search = "50%_discount"
+sql, params = tsql.render(t"SELECT * FROM products WHERE name LIKE {search:%like%}")
+# ('SELECT * FROM products WHERE name LIKE ? ESCAPE '\\'', ['%50\\%\\_discount%'])
+# Matches the literal string "50%_discount", not "50X" or "50Xdiscount"
+```
+
+**For controlled values where you WANT wildcards**, build the pattern manually without format specs:
+
+```python
+# Developer-controlled pattern (wildcards intentional)
+pattern = f"%{category}%"
+sql, params = tsql.render(t"SELECT * FROM products WHERE tags LIKE {pattern}")
+# No escaping - % and _ work as wildcards
+```
+
 #### Tuples for IN clauses
 
 Use tuples to expand lists of values for SQL IN clauses:

t_sql-4.7.1/PKG-INFO → t_sql-4.9.0/README.md

@@ -1,13 +1,3 @@
-Metadata-Version: 2.4
-Name: t-sql
-Version: 4.7.1
-Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
-Project-URL: Homepage, https://github.com/nhumrich/t-sql
-License-File: LICENSE
-Requires-Python: >=3.14
-Requires-Dist: alembic>=1.17.0
-Description-Content-Type: text/markdown
-
 # t-sql
 
 A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP 750).
@@ -115,6 +105,45 @@ sql, params = tsql.render(t"UPDATE users SET {values:as_set} WHERE id='abc123'")
 # ('UPDATE users SET name = ?, email = ? WHERE id='abc123'', ['joe', 'joe@example.com'])
 ```
 
+#### LIKE Pattern Matching
+
+**Safe pattern matching with automatic wildcard escaping**:
+
+```python
+# Contains search (%value%)
+search = "john"
+sql, params = tsql.render(t"SELECT * FROM users WHERE name ILIKE {search:%like%}")
+# ('SELECT * FROM users WHERE name ILIKE ? ESCAPE '\\'', ['%john%'])
+
+# Prefix search (value% - starts with)
+prefix = "admin"
+sql, params = tsql.render(t"SELECT * FROM users WHERE username LIKE {prefix:like%}")
+# ('SELECT * FROM users WHERE username LIKE ? ESCAPE '\\'', ['admin%'])
+
+# Suffix search (%value - ends with)
+domain = "@gmail.com"
+sql, params = tsql.render(t"SELECT * FROM users WHERE email LIKE {domain:%like}")
+# ('SELECT * FROM users WHERE email LIKE ? ESCAPE '\\'', ['%@gmail.com'])
+```
+
+**Security**: All LIKE format specs automatically escape `%`, `_`, and `\` wildcards in user input to prevent injection attacks:
+
+# Wildcards in data are escaped
+search = "50%_discount"
+sql, params = tsql.render(t"SELECT * FROM products WHERE name LIKE {search:%like%}")
+# ('SELECT * FROM products WHERE name LIKE ? ESCAPE '\\'', ['%50\\%\\_discount%'])
+# Matches the literal string "50%_discount", not "50X" or "50Xdiscount"
+```
+
+**For controlled values where you WANT wildcards**, build the pattern manually without format specs:
+
+```python
+# Developer-controlled pattern (wildcards intentional)
+pattern = f"%{category}%"
+sql, params = tsql.render(t"SELECT * FROM products WHERE tags LIKE {pattern}")
+# No escaping - % and _ work as wildcards
+```
+
 #### Tuples for IN clauses
 
 Use tuples to expand lists of values for SQL IN clauses:

{t_sql-4.7.1 → t_sql-4.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "t-sql"
-version = "4.7.1"
+version = "4.9.0"
 description = "Safe SQL. SQL queries for python t-strings (PEP 750)"
 readme = "README.md"
 requires-python = ">=3.14"

{t_sql-4.7.1 → t_sql-4.9.0}/tests/test_asyncpg_integration.py

@@ -268,4 +268,105 @@ async def test_datetime_comparison_with_asyncpg(conn):
     # Should find User2 and User3 (created within last 15 minutes)
     assert len(rows) == 2
     names = sorted([row['name'] for row in rows])
-    assert names == ['User2', 'User3']
+    assert names == ['User2', 'User3']
+
+
+async def test_like_pattern_format_specs_with_postgres(conn):
+    """Test LIKE pattern format specs with PostgreSQL"""
+    # Insert test data with special characters
+    await conn.execute(
+        "INSERT INTO test_users (name) VALUES ($1), ($2), ($3), ($4)",
+        'john_doe', 'john%smith', 'alice', 'admin_50%'
+    )
+
+    # Test contains pattern (%like%)
+    search = "john"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {search:%like%} ORDER BY name",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    assert "ESCAPE '\\'" in sql
+    assert params == ['%john%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match both john_doe and john%smith
+    assert len(rows) == 2
+    names = sorted([row['name'] for row in rows])
+    assert names == ['john%smith', 'john_doe']
+
+    # Test prefix pattern (like%)
+    prefix = "admin"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {prefix:like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    assert params == ['admin%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'admin_50%'
+
+    # Test wildcard escaping - searching for literal underscore
+    search = "john_"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {search:%like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    # Should escape the underscore
+    assert params == ['%john\\_%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match only john_doe (literal underscore after "john")
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'john_doe'
+
+    # Test wildcard escaping - searching for literal percent
+    search = "50%"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {search:%like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    # Should escape the percent
+    assert params == ['%50\\%%']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'admin_50%'
+
+    # Test suffix pattern (%like)
+    suffix = "_doe"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name LIKE {suffix:%like}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    # Underscore should be escaped
+    assert params == ['%\\_doe']
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match john_doe
+    assert len(rows) == 1
+    assert rows[0]['name'] == 'john_doe'
+
+    # Test ILIKE (case-insensitive) works too
+    search = "JOHN"
+    sql, params = tsql.render(
+        t"SELECT name FROM test_users WHERE name ILIKE {search:%like%}",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+
+    rows = await conn.fetch(sql, *params)
+
+    # Should match both john_doe and john%smith (case-insensitive)
+    assert len(rows) == 2

t_sql-4.9.0/tests/test_like_patterns.py

@@ -0,0 +1,282 @@
+"""Tests for LIKE pattern format specs."""
+
+import pytest
+import tsql
+from tsql.styles import QMARK, NUMERIC, NAMED, FORMAT, PYFORMAT, NUMERIC_DOLLAR
+
+
+class TestLikePatternBasics:
+    """Test basic LIKE pattern functionality."""
+
+    def test_like_contains_pattern(self):
+        """Test %like% format spec produces contains pattern."""
+        search = "john"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}")
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\'"
+        assert params == ['%john%']
+
+    def test_like_prefix_pattern(self):
+        """Test like% format spec produces starts-with pattern."""
+        search = "admin"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:like%}")
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\'"
+        assert params == ['admin%']
+
+    def test_like_suffix_pattern(self):
+        """Test %like format spec produces ends-with pattern."""
+        search = ".com"
+        sql, params = tsql.render(t"SELECT * FROM emails WHERE address LIKE {search:%like}")
+
+        assert sql == "SELECT * FROM emails WHERE address LIKE ? ESCAPE '\\'"
+        assert params == ['%.com']
+
+
+class TestWildcardEscaping:
+    """Test that wildcards are properly escaped."""
+
+    def test_escapes_percent_wildcard(self):
+        """Test that % is escaped to \\%."""
+        search = "50%"
+        sql, params = tsql.render(t"SELECT * FROM products WHERE discount LIKE {search:%like%}")
+
+        assert params == ['%50\\%%']
+
+    def test_escapes_underscore_wildcard(self):
+        """Test that _ is escaped to \\_."""
+        search = "user_name"
+        sql, params = tsql.render(t"SELECT * FROM logs WHERE field LIKE {search:%like%}")
+
+        assert params == ['%user\\_name%']
+
+    def test_escapes_backslash(self):
+        """Test that \\ is escaped to \\\\."""
+        search = "C:\\Users"
+        sql, params = tsql.render(t"SELECT * FROM paths WHERE path LIKE {search:%like%}")
+
+        assert params == ['%C:\\\\Users%']
+
+    def test_escapes_all_wildcards_together(self):
+        """Test multiple wildcards in one value."""
+        search = "test_50%\\path"
+        sql, params = tsql.render(t"SELECT * FROM mixed WHERE value LIKE {search:%like%}")
+
+        assert params == ['%test\\_50\\%\\\\path%']
+
+    def test_empty_string(self):
+        """Test empty string produces just the pattern."""
+        search = ""
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}")
+
+        assert params == ['%%']
+
+
+class TestSecurityScenarios:
+    """Test that injection attempts are neutralized."""
+
+    def test_prevents_wildcard_injection_contains(self):
+        """Test that user can't inject wildcards to expand search."""
+        malicious = "%admin"  # Trying to search for anything containing 'admin'
+        sql, params = tsql.render(t"SELECT * FROM users WHERE username LIKE {malicious:like%}")
+
+        # Should match literally '%admin' followed by anything
+        assert params == ['\\%admin%']
+
+    def test_prevents_full_table_scan(self):
+        """Test that % alone doesn't create %%."""
+        malicious = "%"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {malicious:%like%}")
+
+        # Should match literally '%' anywhere
+        assert params == ['%\\%%']
+
+    def test_prevents_sql_injection_attempt(self):
+        """Test that SQL injection attempts are treated as literals."""
+        malicious = "%'; DROP TABLE users; --"
+        sql, params = tsql.render(t"SELECT * FROM logs WHERE message LIKE {malicious:%like%}")
+
+        # Everything is escaped and parameterized
+        assert "DROP TABLE" in params[0]  # Present in parameter value
+        assert "DROP TABLE" not in sql  # Not in SQL itself
+        assert params == ["%\\%'; DROP TABLE users; --%"]
+
+
+class TestTypeHandling:
+    """Test type conversion and None handling."""
+
+    def test_converts_int_to_string(self):
+        """Test that integers are converted to strings."""
+        number = 42
+        sql, params = tsql.render(t"SELECT * FROM products WHERE code LIKE {number:%like%}")
+
+        assert params == ['%42%']
+
+    def test_converts_float_to_string(self):
+        """Test that floats are converted to strings."""
+        number = 3.14
+        sql, params = tsql.render(t"SELECT * FROM values WHERE val LIKE {number:%like%}")
+
+        assert params == ['%3.14%']
+
+    def test_none_raises_error_contains(self):
+        """Test that None raises ValueError for %like%."""
+        value = None
+        with pytest.raises(ValueError, match="LIKE pattern value cannot be None"):
+            tsql.render(t"SELECT * FROM users WHERE name LIKE {value:%like%}")
+
+    def test_none_raises_error_prefix(self):
+        """Test that None raises ValueError for like%."""
+        value = None
+        with pytest.raises(ValueError, match="LIKE pattern value cannot be None"):
+            tsql.render(t"SELECT * FROM users WHERE name LIKE {value:like%}")
+
+    def test_none_raises_error_suffix(self):
+        """Test that None raises ValueError for %like."""
+        value = None
+        with pytest.raises(ValueError, match="LIKE pattern value cannot be None"):
+            tsql.render(t"SELECT * FROM users WHERE name LIKE {value:%like}")
+
+
+class TestMultipleParameters:
+    """Test queries with multiple LIKE clauses."""
+
+    def test_multiple_like_patterns_in_one_query(self):
+        """Test that multiple LIKE patterns work correctly."""
+        name = "john"
+        email = "gmail"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {name:%like%} OR email LIKE {email:%like}")
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\' OR email LIKE ? ESCAPE '\\'"
+        assert params == ['%john%', '%gmail']
+
+    def test_mixed_like_patterns(self):
+        """Test different pattern types in one query."""
+        prefix = "admin"
+        suffix = ".com"
+        contains = "test"
+        sql, params = tsql.render(t"""
+            SELECT * FROM data
+            WHERE username LIKE {prefix:like%}
+            AND email LIKE {suffix:%like}
+            AND description LIKE {contains:%like%}
+        """)
+
+        assert params == ['admin%', '%.com', '%test%']
+        assert sql.count("ESCAPE '\\'") == 3
+
+
+class TestParameterStyles:
+    """Test that LIKE patterns work with different parameter styles."""
+
+    def test_qmark_style(self):
+        """Test with ? placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", QMARK)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE ? ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_numeric_style(self):
+        """Test with :1, :2, ... placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", NUMERIC)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE :1 ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_numeric_dollar_style(self):
+        """Test with $1, $2, ... placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", NUMERIC_DOLLAR)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE $1 ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_named_style(self):
+        """Test with :name placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", NAMED)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE :search ESCAPE '\\'"
+        assert params == {'search': '%test%'}
+
+    def test_format_style(self):
+        """Test with %s placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", FORMAT)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE %s ESCAPE '\\'"
+        assert params == ['%test%']
+
+    def test_pyformat_style(self):
+        """Test with %(name)s placeholders."""
+        search = "test"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}", PYFORMAT)
+
+        assert sql == "SELECT * FROM users WHERE name LIKE %(search)s ESCAPE '\\'"
+        assert params == {'search': '%test%'}
+
+
+class TestCaseSensitivity:
+    """Test that LIKE vs ILIKE is orthogonal to pattern specs."""
+
+    def test_like_case_sensitive(self):
+        """Test LIKE with pattern."""
+        search = "John"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name LIKE {search:%like%}")
+
+        assert "LIKE" in sql
+        assert "ILIKE" not in sql
+        assert params == ['%John%']
+
+    def test_ilike_case_insensitive(self):
+        """Test ILIKE with pattern."""
+        search = "John"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE name ILIKE {search:%like%}")
+
+        assert "ILIKE" in sql
+        assert params == ['%John%']
+
+
+class TestRealWorldScenarios:
+    """Test realistic usage patterns."""
+
+    def test_user_search_box(self):
+        """Test typical user search functionality."""
+        user_input = "john doe"
+        sql, params = tsql.render(t"""
+            SELECT id, name, email
+            FROM users
+            WHERE name ILIKE {user_input:%like%}
+            ORDER BY name
+        """)
+
+        assert params == ['%john doe%']
+
+    def test_email_domain_filter(self):
+        """Test filtering by email domain."""
+        domain = "@gmail.com"
+        sql, params = tsql.render(t"SELECT * FROM users WHERE email LIKE {domain:%like}")
+
+        assert params == ['%@gmail.com']
+
+    def test_username_prefix_search(self):
+        """Test username autocomplete."""
+        prefix = "adm"
+        sql, params = tsql.render(t"""
+            SELECT username
+            FROM users
+            WHERE username LIKE {prefix:like%}
+            LIMIT 10
+        """)
+
+        assert params == ['adm%']
+
+    def test_log_message_search_with_special_chars(self):
+        """Test searching logs that might contain special characters."""
+        search = "Error: 50% complete [user_123]"
+        sql, params = tsql.render(t"SELECT * FROM logs WHERE message LIKE {search:%like%}")
+
+        # All special chars should be escaped
+        assert params == ['%Error: 50\\% complete [user\\_123]%']

{t_sql-4.7.1 → t_sql-4.9.0}/tests/test_query_builder.py

@@ -1431,3 +1431,104 @@ def test_nested_querybuilder_with_different_styles():
     assert len(params) == 2
     assert 42 in params.values() and 5 in params.values()
     assert 'SELECT posts.user_id FROM posts WHERE posts.id = :' in sql
+
+
+# CTE Tests
+
+def test_basic_cte():
+    """Test basic CTE with query builder"""
+    from tsql.query_builder import SelectQueryBuilder
+
+    query = (
+        SelectQueryBuilder.from_table('active_users')
+        .with_cte('active_users', Users.select(Users.id, Users.username).where(Users.email == 'test@example.com'))
+        .select('id', 'username')
+    )
+
+    sql, params = query.render()
+    assert sql == "WITH active_users AS (SELECT users.id, users.username FROM users WHERE users.email = ?) SELECT id, username FROM active_users"
+    assert params == ['test@example.com']
+
+
+def test_cte_with_tstring():
+    """Test CTE with raw t-string query"""
+    from tsql.query_builder import SelectQueryBuilder
+
+    query = (
+        SelectQueryBuilder.from_table('counts')
+        .with_cte('counts', t'SELECT COUNT(*) as total FROM users')
+        .select('total')
+    )
+
+    sql, _ = query.render()
+    assert "WITH counts AS (SELECT COUNT(*) as total FROM users)" in sql
+    assert "SELECT total FROM counts" in sql
+
+
+def test_multiple_ctes():
+    """Test chaining multiple CTEs"""
+    from tsql.query_builder import SelectQueryBuilder
+
+    query = (
+        SelectQueryBuilder.from_table('filtered')
+        .with_cte('jennifers', Users.select(Users.id, Users.username).where(Users.username == 'Jennifer'))
+        .with_cte('filtered', t'SELECT id FROM jennifers WHERE id > 18')
+    )
+
+    sql, _ = query.render()
+    assert "WITH jennifers AS" in sql
+    assert ", filtered AS" in sql
+    assert "SELECT * FROM filtered" in sql
+
+
+def test_recursive_cte():
+    """Test recursive CTE with t-string"""
+    from tsql.query_builder import SelectQueryBuilder
+
+    query = (
+        SelectQueryBuilder.from_table('category_tree')
+        .with_cte('category_tree', t'''
+            SELECT id, name, parent_id, 1 as level
+            FROM categories
+            WHERE parent_id IS NULL
+            UNION ALL
+            SELECT c.id, c.name, c.parent_id, ct.level + 1
+            FROM categories c
+            JOIN category_tree ct ON c.parent_id = ct.id
+        ''', recursive=True)
+    )
+
+    sql, _ = query.render()
+    assert sql.startswith("WITH RECURSIVE category_tree AS")
+    assert "SELECT * FROM category_tree" in sql
+
+
+def test_cte_name_validation():
+    """Test CTE name is validated as identifier"""
+    from tsql.query_builder import SelectQueryBuilder
+    import pytest
+
+    query = SelectQueryBuilder.from_table('test')
+
+    with pytest.raises(ValueError, match="Invalid CTE name"):
+        query.with_cte('invalid-name', t'SELECT 1')
+
+    with pytest.raises(ValueError, match="Invalid CTE name"):
+        query.with_cte('123start', t'SELECT 1')
+
+
+def test_multiple_recursive_ctes():
+    """Test multiple CTEs where one is recursive"""
+    from tsql.query_builder import SelectQueryBuilder
+
+    query = (
+        SelectQueryBuilder.from_table('result')
+        .with_cte('normal', t'SELECT id FROM users')
+        .with_cte('tree', t'SELECT id FROM tree UNION ALL SELECT id+1 FROM tree WHERE id < 10', recursive=True)
+    )
+
+    sql, _ = query.render()
+    # Should use WITH RECURSIVE if ANY CTE is recursive
+    assert sql.startswith("WITH RECURSIVE")
+    assert "normal AS" in sql
+    assert "tree AS" in sql

{t_sql-4.7.1 → t_sql-4.9.0}/tests/test_sqlite_integration.py

@@ -349,3 +349,83 @@ async def test_query_builder_select(conn):
     rows = await cursor.fetchall()
 
     assert len(rows) == 1
+
+
+async def test_like_pattern_format_specs(conn):
+    """Test LIKE pattern format specs with SQLite"""
+    # Insert test data with special characters
+    await conn.execute(
+        "INSERT INTO test_users (name) VALUES (?), (?), (?), (?)",
+        ('john_doe', 'john%smith', 'alice', 'admin_50%')
+    )
+    await conn.commit()
+
+    # Test contains pattern (%like%)
+    search = "john"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {search:%like%} ORDER BY name")
+
+    assert "ESCAPE '\\'" in sql
+    assert params == ['%john%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match both john_doe and john%smith
+    assert len(rows) == 2
+    assert rows[0][0] == 'john%smith'
+    assert rows[1][0] == 'john_doe'
+
+    # Test prefix pattern (like%)
+    prefix = "admin"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {prefix:like%}")
+
+    assert params == ['admin%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0][0] == 'admin_50%'
+
+    # Test wildcard escaping - searching for literal underscore
+    search = "john_"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {search:%like%}")
+
+    # Should escape the underscore
+    assert params == ['%john\\_%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match only john_doe (literal underscore after "john")
+    assert len(rows) == 1
+    assert rows[0][0] == 'john_doe'
+
+    # Test wildcard escaping - searching for literal percent
+    search = "50%"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {search:%like%}")
+
+    # Should escape the percent
+    assert params == ['%50\\%%']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match admin_50%
+    assert len(rows) == 1
+    assert rows[0][0] == 'admin_50%'
+
+    # Test suffix pattern (%like)
+    suffix = "_doe"
+    sql, params = tsql.render(t"SELECT name FROM test_users WHERE name LIKE {suffix:%like}")
+
+    # Underscore should be escaped
+    assert params == ['%\\_doe']
+
+    cursor = await conn.execute(sql, params)
+    rows = await cursor.fetchall()
+
+    # Should match john_doe
+    assert len(rows) == 1
+    assert rows[0][0] == 'john_doe'

{t_sql-4.7.1 → t_sql-4.9.0}/tsql/__init__.py

@@ -24,6 +24,11 @@ def set_style(style: type[ParamStyle]):
     default_style = style
 
 
+def _escape_like(value: str) -> str:
+    # Order matters: escape backslash first to avoid double-escaping
+    return value.replace('\\', '\\\\').replace('%', '\\%').replace('_', '\\_')
+
+
 class Parameter:
     _expression: str
     _value: Any
@@ -141,6 +146,28 @@ class TSQL:
                     return as_values(value)._sql_parts
                 case 'as_set', dict():
                     return as_set(value)._sql_parts
+                case fmt_spec, _ if fmt_spec in ('%like%', 'like%', '%like'):  # LIKE patterns
+                    if value is None:
+                        raise ValueError(
+                            f"LIKE pattern value cannot be None for {{value:{fmt_spec}}}. "
+                            f"Use a non-None value or handle None before the query."
+                        )
+                    str_value = str(value)
+                    escaped = _escape_like(str_value)
+
+                    # Apply pattern based on format spec
+                    if fmt_spec == '%like%':
+                        wrapped = f"%{escaped}%"
+                        pattern_type = "contains"
+                    elif fmt_spec == 'like%':
+                        wrapped = f"{escaped}%"
+                        pattern_type = "prefix"
+                    else:  # '%like'
+                        wrapped = f"%{escaped}"
+                        pattern_type = "suffix"
+
+                    logger.debug("LIKE %s pattern: %r -> %r (escaped: %r)", pattern_type, value, wrapped, escaped)
+                    return [Parameter(val.expression, wrapped), " ESCAPE '\\'"]
                 case '', TSQL():
                     return val.value._sql_parts
                 case "", Template():

{t_sql-4.7.1 → t_sql-4.9.0}/tsql/query_builder.py

@@ -1161,6 +1161,7 @@ class SelectQueryBuilder(QueryBuilder):
         self._order_by_columns: List[tuple[Union[Column, str], str]] = []
         self._limit_value: Optional[int] = None
         self._offset_value: Optional[int] = None
+        self._ctes: List[tuple[str, Union[Template, TSQL, 'SelectQueryBuilder'], bool]] = []
 
     @classmethod
     def from_table(cls, table_name: str, schema: Optional[str] = None) -> 'SelectQueryBuilder':
@@ -1283,10 +1284,85 @@ class SelectQueryBuilder(QueryBuilder):
         self._offset_value = n
         return self
 
+    def with_cte(self, name: str,
+                 query: Union[Template, TSQL, 'SelectQueryBuilder'],
+                 recursive: bool = False) -> 'SelectQueryBuilder':
+        """Add a CTE to this query's WITH clause.
+
+        Multiple CTEs can be chained by calling this method multiple times.
+
+        Args:
+            name: CTE name (validated as valid identifier)
+            query: The CTE query (SelectQueryBuilder, t-string Template, or TSQL)
+            recursive: Whether this CTE is recursive (adds RECURSIVE keyword)
+
+        Returns:
+            Self for method chaining
+
+        Example:
+            # Basic CTE
+            query = (
+                SelectQueryBuilder.from_table('active_users')
+                .with_cte('active_users', Users.select().where(Users.active == True))
+                .select('id', 'name')
+            )
+
+            # Multiple CTEs
+            query = (
+                SelectQueryBuilder.from_table('filtered')
+                .with_cte('jennifers', Users.select().where(...))
+                .with_cte('filtered', t'SELECT id FROM jennifers WHERE age > 18')
+                .select('*')
+            )
+
+            # Recursive CTE
+            query = (
+                SelectQueryBuilder.from_table('tree')
+                .with_cte('tree', t'''
+                    SELECT id, name, parent_id FROM categories WHERE parent_id IS NULL
+                    UNION ALL
+                    SELECT c.id, c.name, c.parent_id FROM categories c
+                    JOIN tree t ON c.parent_id = t.id
+                ''', recursive=True)
+                .select('*')
+            )
+        """
+        if not name.isidentifier():
+            raise ValueError(f"Invalid CTE name: {name!r}. Must be a valid Python identifier.")
+
+        self._ctes.append((name, query, recursive))
+        return self
+
     def to_tsql(self) -> TSQL:
         """Build the final TSQL object"""
         parts: List[Template] = []
 
+        # Render CTEs if present
+        if self._ctes:
+            has_recursive = any(recursive for _, _, recursive in self._ctes)
+            cte_parts = []
+
+            for name, query, _ in self._ctes:
+                # Convert CTE query to TSQL
+                if hasattr(query, 'to_tsql'):
+                    cte_sql = query.to_tsql()
+                elif isinstance(query, Template):
+                    cte_sql = TSQL(query)
+                else:
+                    cte_sql = query
+
+                # Render as: cte_name AS (query)
+                cte_parts.append(t'{name:literal} AS ({cte_sql})')
+
+            # Join all CTEs with commas
+            cte_clause = t_join(t', ', cte_parts)
+
+            # Add WITH or WITH RECURSIVE
+            if has_recursive:
+                parts.append(t'WITH RECURSIVE {cte_clause}')
+            else:
+                parts.append(t'WITH {cte_clause}')
+
         if self._columns:
             # Build column list, handling Column objects, Template (t-string) objects, and strings
             column_parts = []