How to Prepare a %LIKE% SQL Statement in WordPress

The wordpress prepare like pattern is always the same: put the placeholder %s in the SQL string, put the literal % wildcards around the value when you pass it in. The common wrong attempt — writing LIKE '%%s%' inside the query and passing just $text — confuses prepare()‘s printf-style formatter and breaks. This guide shows the correct shape, the esc_like() step that keeps user-supplied metacharacters from leaking semantics, and when to skip $wpdb entirely for WordPress’s built-in query classes.

Last verified: 2026-04-23 on WordPress 6.5 and PHP 8.3. Originally published 2022-10-07, rewritten and updated 2026-04-23.

TL;DR

$sql = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}my_table WHERE column LIKE %s",
    '%' . $wpdb->esc_like( $text ) . '%'
);

$rows = $wpdb->get_results( $sql );

Why the common attempt breaks

First instinct is to keep the wildcards in the query string:

// Broken
$wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}my_table WHERE column LIKE '%%s%'",
    $text
);

prepare() formats the query through a printf-style routine, where %% means a literal % and %s is the string placeholder. So %%s% parses as “literal percent, placeholder, orphan percent” — the orphan confuses the formatter and the output is malformed SQL.

The correct shape

$wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}my_table WHERE column LIKE %s",
    '%' . $text . '%'
);

Two changes:

• The SQL string has only a clean %s placeholder — no literal % around it.
• The value being passed in is already wrapped with '%'‘s — PHP concatenation, before prepare() sees it.

prepare() then wraps the whole bound value in quotes and produces valid SQL: WHERE column LIKE '%my search%'.

Add esc_like() for user input

$like = '%' . $wpdb->esc_like( $text ) . '%';

$sql = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}my_table WHERE column LIKE %s",
    $like
);

$wpdb->esc_like() escapes MySQL’s LIKE metacharacters — the literal % and _ a user might type. Without it, a search for “50% off” behaves as “starts with 50” (the % becomes a wildcard); with it, the search matches only the literal string.

Two escape stages at play:

• esc_like() — escapes LIKE-specific metacharacters so user input matches as written.
• $wpdb->prepare() — escapes SQL-injection risks (quotes, null bytes, backslashes).

Both are needed for user-supplied search strings.

Common patterns

// 1. Match anywhere: %text%
$like = '%' . $wpdb->esc_like( $text ) . '%';

// 2. Starts-with: text%
$like = $wpdb->esc_like( $text ) . '%';

// 3. Ends-with: %text
$like = '%' . $wpdb->esc_like( $text );

// 4. Multi-column LIKE with OR
$sql = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}my_table
     WHERE column_a LIKE %s OR column_b LIKE %s",
    $like,
    $like
);

The multi-column form passes the same $like value twice — one for each %s. prepare() substitutes positional arguments in order, so you can bind the same variable multiple times without repeating the concatenation.

When to skip $wpdb

WordPress’s built-in query classes already handle LIKE correctly — you just pass the search term and WordPress wraps the wildcards internally:

// Posts
$query = new WP_Query( array( 's' => $text ) );

// Users — see the dedicated guide for search_columns
$users = new WP_User_Query( array(
    'search'         => '*' . $text . '*',
    'search_columns' => array( 'user_login', 'user_email', 'display_name' ),
) );

Drop to raw $wpdb for custom tables (your plugin’s own schema) or for joins WordPress’s classes don’t expose. For anything WordPress provides a class for, the class version is shorter, cached correctly, and less error-prone.

Frequently asked questions

Related guides

• How to Retrieve the Last Inserted Row ID in WordPress — the companion $wpdb pattern for INSERTs.
• How to Search Users by Multiple Fields in WordPress — built-in class equivalent for user search.
• How to Order Posts by Meta Value in WordPress — another WP_Query pattern instead of raw SQL.
• How to Get Posts by Date Range in WordPress — date_query vs raw $wpdb.

References

WordPress developer reference for $wpdb->prepare and $wpdb->esc_like: developer.wordpress.org/reference/classes/wpdb/prepare.