Funny - I just exchanged an e-mail with someone about this tool this
morning, the Galaxy-P dbbuilder tool escapes exactly this santizing.
Here is the relevant portion:

        <param name="url" value="" type="text" label="URL (http, ftp)">
          <sanitizer>
            <valid>
              <add value="%"/>
            </valid>
          </sanitizer>
        </param>

The full tool is on the tool shed.

https://toolshed.g2.bx.psu.edu/repos/galaxyp/dbbuilder

Hope this helps.

-John

On Tue, Sep 9, 2014 at 10:08 PM, Melissa Cline <cline@soe.ucsc.edu> wrote:
> Hi folks,
>
> I'm working on a tool that queries a database based on user input, where
> this user input is a text parameter.  The wildcard for the database is the
> percent (%) character.  The user input, which is ultimately translated into
> the query, should be able to contain a % character.  For example, one input
> field lets the user indicate which cancer cohort he or she is interested in,
> in a table of available cohorts, and the user should be able to give input
> like 'TCGA%" to indicate all TCGA cohorts.
>
> The problem I'm having is that when % is given in the input field, it's
> translated (to X) by the time it reaches my tool's python script.  I haven't
> been able to figure out the right way to escape the input so that % is not
> translated.
>
> So, how do I escape this?
>
> Thanks!
>
> Melissa
>
>

> ___________________________________________________________
> Please keep all replies on the list by using "reply all"
> in your mail client.  To manage your subscriptions to this
> and other Galaxy lists, please use the interface at:
>   http://lists.bx.psu.edu/
>
> To search Galaxy mailing lists use the unified search at:
>   http://galaxyproject.org/search/mailinglists/