参数已经绑定，搜索 20% 为什么还是匹配了一大片？

"""Actual SQLite LIKE comparisons; only a fresh in-memory database is used."""
from contextlib import closing
from pathlib import Path
import csv
import json
import sqlite3
import sys


def literal_pattern(term):
    if not isinstance(term, str) or not term or "\x00" in term:
        raise ValueError("use a non-empty text term without NUL")
    # Escape the escape character first, then the pattern metacharacters.
    return "%" + term.replace("!", "!!").replace("%", "!%").replace("_", "!_") + "%"


def main():
    records = [(1, "20%折扣"), (2, "200折扣"), (3, "20_折扣"),
               (4, "20!折扣"), (5, "O'Reilly"), (6, "ordinary")]
    expected = {"20%": ([1, 2, 3, 4], [1]), "20_": ([1, 2, 3, 4], [3]),
                "20!": ([4], [4]), "O'Reilly": ([5], [5]),
                "' OR 1=1 --": ([], [])}
    rows = []
    with closing(sqlite3.connect(":memory:")) as db:
        db.execute("CREATE TABLE label(id INTEGER PRIMARY KEY, name TEXT NOT NULL)")
        db.executemany("INSERT INTO label VALUES (?, ?)", records)
        for term, (raw_ids, literal_ids) in expected.items():
            for mode, pattern, sql, wanted in [
                ("bound_pattern", "%" + term + "%", "SELECT id FROM label WHERE name LIKE ? ORDER BY id", raw_ids),
                ("bound_literal", literal_pattern(term), "SELECT id FROM label WHERE name LIKE ? ESCAPE '!' ORDER BY id", literal_ids),
            ]:
                ids = [r[0] for r in db.execute(sql, (pattern,))]
                assert ids == wanted, (term, mode, ids)
                rows.append({"term": term, "mode": mode, "bound_value": pattern, "matched_ids": ids})
        assert db.execute("SELECT COUNT(*) FROM label").fetchone()[0] == 6
        case_rules = db.execute("SELECT 'a' LIKE 'A', 'æ' LIKE 'Æ'").fetchone()
        assert case_rules == (1, 0), "this lesson expects SQLite's built-in LIKE without ICU/overrides"
        try:
            db.execute("SELECT 'x' LIKE ? ESCAPE '!!'", ("x",)).fetchone()
        except sqlite3.OperationalError:
            invalid_escape_rejected = True
        else:
            raise AssertionError("two-character ESCAPE accepted")
    rejected = []
    for term in ["", "a\x00b", None]:
        try:
            literal_pattern(term)
        except ValueError:
            rejected.append(repr(term))
        else:
            raise AssertionError("invalid search term accepted")
    report = {"python": sys.version.split()[0], "sqlite": sqlite3.sqlite_version,
              "scope": "real SQLite, built-in LIKE, in-memory fixture; no performance test",
              "records": records, "comparisons": rows,
              "ascii_case_match": bool(case_rules[0]), "non_ascii_case_match": bool(case_rules[1]),
              "two_character_escape_rejected": invalid_escape_rejected,
              "rejected_terms": rejected}
    out = Path(__file__).resolve().parent / "like-output"
    out.mkdir(exist_ok=True)
    (out / "report.json").write_text(json.dumps(report, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
    with (out / "matches.csv").open("w", encoding="utf-8-sig", newline="") as file:
        writer = csv.DictWriter(file, fieldnames=["term", "mode", "bound_value", "matched_ids"])
        writer.writeheader()
        writer.writerows({**r, "matched_ids": json.dumps(r["matched_ids"])} for r in rows)
    print(json.dumps(report, ensure_ascii=False, indent=2))
    print("PASS: 10 bound-query comparisons, escape validation and explicit input policy")


if __name__ == "__main__":
    main()