How can PHP prevent encoding issues in SQL-LIKE statements?

When using SQL-LIKE statements in PHP, it's essential to properly escape and sanitize user input to prevent encoding issues and potential SQL injection attacks. One way to achieve this is by using prepared statements with parameterized queries, which automatically handle escaping and encoding of input values. 

// Example of preventing encoding issues in SQL-LIKE statements using prepared statements

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// User input
$searchTerm = $_POST['search'];

// Prepare a SQL query with a placeholder for the search term
$stmt = $pdo->prepare("SELECT * FROM table WHERE column LIKE :searchTerm");

// Bind the sanitized search term to the placeholder
$stmt->bindValue(':searchTerm', '%' . $searchTerm . '%', PDO::PARAM_STR);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Display the results
foreach ($results as $result) {
    echo $result['column'] . "<br>";
}

Keywords

PHP encoding SQL-LIKE prepared statements character set

Related Questions