How can SQL Injections be prevented when using LIKE in MySQL queries in PHP?

To prevent SQL Injections when using LIKE in MySQL queries in PHP, you should use prepared statements with bound parameters. This way, user input is treated as data rather than executable SQL code, making it safe from injection attacks. 

// Assuming $searchTerm contains the user input for the LIKE query
$searchTerm = $_POST['search_term'];

// Prepare a SQL statement with a placeholder for the search term
$stmt = $pdo->prepare("SELECT * FROM table_name WHERE column_name LIKE :searchTerm");

// Bind the search term parameter and execute the query
$stmt->bindParam(':searchTerm', $searchTerm, PDO::PARAM_STR);
$stmt->execute();

// Fetch results as needed

Keywords

SQL Injection LIKE operator MySQL queries PHP security Prepared statements

Related Questions