This is part of why I prefer to use LIKE directly when the thing I'm doing isn't actually a regexp. Then again, it's equally easy to screw up the %, but I feel it's maybe more visible (due to the less common characters). [My primary reason is clarity for the reader, so they don't have to attempt to parse the potential regexp].

More pernicious than ? is . though. Not that it matters in your case, but a lot of matches really can be "oops, a one character substitution totally matches, too".