fix: skip %-formatting in cursor.execute() when no parameters are provided

Queries containing literal percent signs (e.g. LIKE '%good') would raise
TypeError/ValueError because Python's % operator tried to interpret them
as format specifiers even when no parameters were passed.

Only apply parameter substitution when parameters is non-empty.

Author: james-willis

tests/test_cursor.py

@@ -0,0 +1,87 @@
+"""Tests for Cursor class behavior.
+
+These tests verify that:
+1. SQL queries containing literal percent signs (e.g., LIKE '%good') work
+   correctly when no parameters are provided.
+2. Parameter substitution still works when parameters are provided.
+"""
+
+from unittest.mock import MagicMock
+
+from wherobots.db.cursor import Cursor
+
+
+def _make_cursor():
+    """Create a Cursor with a mock exec_fn that captures the SQL sent."""
+    captured = {}
+
+    def mock_exec_fn(sql, handler, store):
+        captured["sql"] = sql
+        return "exec-1"
+
+    mock_cancel_fn = MagicMock()
+    cursor = Cursor(mock_exec_fn, mock_cancel_fn)
+    return cursor, captured
+
+
+class TestCursorExecuteParameterSubstitution:
+    """Tests for parameter substitution in cursor.execute()."""
+
+    def test_like_percent_without_parameters(self):
+        """A query with a LIKE '%...' pattern and no parameters should not
+        raise a ValueError from Python's % string formatting."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table WHERE name LIKE '%good'"
+        cursor.execute(sql)
+        assert captured["sql"] == sql
+
+    def test_like_percent_at_end_without_parameters(self):
+        """A query with a trailing percent in LIKE should work without parameters."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table WHERE name LIKE 'good%'"
+        cursor.execute(sql)
+        assert captured["sql"] == sql
+
+    def test_like_double_percent_without_parameters(self):
+        """A query with percent on both sides in LIKE should work without parameters."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table WHERE name LIKE '%good%'"
+        cursor.execute(sql)
+        assert captured["sql"] == sql
+
+    def test_multiple_percent_patterns_without_parameters(self):
+        """A query with multiple LIKE clauses containing percents should work."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM t WHERE a LIKE '%foo%' AND b LIKE '%bar'"
+        cursor.execute(sql)
+        assert captured["sql"] == sql
+
+    def test_parameters_none_with_percent_in_query(self):
+        """Explicitly passing parameters=None with a percent-containing query
+        should not raise."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table WHERE name LIKE '%good'"
+        cursor.execute(sql, parameters=None)
+        assert captured["sql"] == sql
+
+    def test_empty_parameters_with_percent_in_query(self):
+        """Passing an empty dict as parameters with a percent-containing query
+        should not raise."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table WHERE name LIKE '%good'"
+        cursor.execute(sql, parameters={})
+        assert captured["sql"] == sql
+
+    def test_parameter_substitution_works(self):
+        """Named parameter substitution should still work correctly."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table WHERE id = %(id)s"
+        cursor.execute(sql, parameters={"id": 42})
+        assert captured["sql"] == "SELECT * FROM table WHERE id = 42"
+
+    def test_plain_query_without_parameters(self):
+        """A simple query with no percent signs and no parameters should work."""
+        cursor, captured = _make_cursor()
+        sql = "SELECT * FROM table"
+        cursor.execute(sql)
+        assert captured["sql"] == sql

wherobots/db/cursor.py

@@ -98,8 +98,9 @@ def execute(
         self.__rowcount = -1
         self.__description = None
 
+        sql = operation % parameters if parameters else operation
         self.__current_execution_id = self.__exec_fn(
-            operation % (parameters or {}), self.__on_execution_result, store
+            sql, self.__on_execution_result, store
         )
 
     def get_store_result(self) -> StoreResult | None: