## Lesson — When constructing LIKE clauses from user input, explicitly

**Tags:** security, sql, lancedb

When constructing `LIKE` clauses from user input, explicitly escape `%`, `_`, and `\` in addition to standard quote escaping. Failure to do so allows users to bypass intended filters via wildcard injection or trigger unexpected matching behavior.
