SQL Errors using like and % - mysql

Question

My script is designed to cycle through environments, hit a database and check to see if any first/last name combination has an associated user ID. I am not sure why I'm getting the error listed below.
#/bin/bash
#specify user to search for *******DO NOT PUT SPACE, ie. jaylefler
echo "Please enter user first name: "
read first_name
echo "Please enter user last name: "
read last_name
echo "Please enter LDAP User ID: "
read ldapuser
echo "Please enter LDAP password: "
stty -echo
read ldappw
stty echo
#logs to write output to
log="ui_${username}_access.log"
finallog="${username}_ui_access.txt"
#create file if not exist, else null it
[[ -f ${log} ]] && cat /dev/null > ${log} || touch ${log}
[[ -f ${finallog} ]] && cat /dev/null > ${finallog} || touch ${log}
#log it all
{
echo "environment"
sshpass -p $ldappw ssh $ldapuser#54.123.777.567 'mysql -h host -u user - ppassword database -e \
"select user_id from users where first like "%'${first_name}'%" and last like "%'${last_name}'%";"'
} > $log
When I execute the script, I receive the following errors:
Please enter user first name:
jay
Please enter user last name:
lefler
Please enter LDAP User ID:
jlefler
Please enter LDAP password:
ERROR 1064 (42000) at line 1: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%jay% and last like %lefler%' at line 1
jlefler#ubuntu:~/Desktop$

Answer 1

I'm not that familiar with this type of scripting, but it would seem to me that around %jay% and %lefler% there would need to be quotations so that the SQL appears as:
select user_id from users where first like '%jay%' and last like '%lefler%';

Answer 2

The primary problem in your code is that the quotation marks are inside of the percent signs. :)
The second problem is that you have created something that is vulnerable to SQL injection. I have absolutely no idea how to create bound parameters from a Bash script, but you need to figure that out!

Answer 3

The query to MySQL is supposed to output something like this:
SELECT * FROM pet WHERE name LIKE '%w%';
In bash one of the way to concatenate is as follow:
mystring="some ${string1} arbitrary ${string2} text"
EDIT:
So combining all Plus making somethin to expand the strings inside ''. The problem is that shell Can not expand strings between single quotations marks.
Something like this should work:
CommandFinale=$($sqlCommand -e "select user_id from users where first like '%${first_name}%' and last like '%${last_name}%';")
Then use the variable CommandFinale in you connection chain.
I have not bee able to test it but it should be like that or very similar.