如何用变量init编写一个sql Like语句

I am trying to concat my php variable with "LIKE" Statement

I am using this query right now

 $sql = "SELECT * FROM roll_header where contract_no like concat '%'$ContractNo'%' ORDER BY timedate DESC";

i have also used something like

   $sql = "SELECT * FROM roll_header where contract_no like  '%'{$ContractNo}'%' ORDER BY timedate DESC";

The purpose of this string is that whatever user writes it gives back all the matching strings

The correct query should look like this

$sql = "SELECT * FROM roll_header where contract_no like '%{$ContractNo}%' ORDER BY timedate DESC";

But, please make sure you sanitize your input (the $ContractNo variable). Not sure what DB adapter you're using but here are the sanitization functions for mysqli and PDO.