Sql statement with like from variable

I'm executing this code in python

from sqlite3 import dbapi2 as sqlite

con = sqlite.connect("db.sqlite")
cur = con.cursor()
sur开发者_如何学Pythonname = "'%atton%'"
cur.execute("select id from singers where surname like :surname", locals())
cur.close()
con.close()

After this code cur.rowcount == -1 but Patton is in the database.

Is my SQL statement bad?

thank you

The DB-API parameterization you use (which you should use, don't change that) means the surname will automatically be quoted or escaped appropriately. You should remove the inner set of quotes from your surname string.

surname = "%atton%"
cur.execute("select id from singers where surname like :surname",
    dict(surname=surname))