How can the use of the LIKE operator in SQL queries impact PHP code execution?

Using the LIKE operator in SQL queries can potentially lead to SQL injection attacks if user input is not properly sanitized. To prevent this, it is crucial to use prepared statements with parameterized queries in PHP. This ensures that user input is treated as data rather than executable SQL code. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM users WHERE username LIKE :username");

// Bind the parameter
$username = '%' . $_POST['username'] . '%';
$stmt->bindParam(':username', $username, PDO::PARAM_STR);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

Keywords

LIKE operator SQL queries PHP code execution impact performance

Related Questions