What are some best practices for using wildcards (%) in LIKE queries in PHP?

When using wildcards (%) in LIKE queries in PHP, it is important to properly sanitize user input to prevent SQL injection attacks. One best practice is to use prepared statements with placeholders to safely insert user input into the query. Additionally, it is recommended to escape any special characters in the user input before using it in the LIKE query to avoid unexpected behavior. 

// Assuming $searchTerm is the user input to search for
$searchTerm = $_GET['searchTerm'];

// Sanitize the user input
$searchTerm = mysqli_real_escape_string($connection, $searchTerm);

// Prepare the SQL statement with a placeholder for the search term
$sql = "SELECT * FROM table_name WHERE column_name LIKE ?";
$stmt = $connection->prepare($sql);

// Bind the search term to the placeholder
$stmt->bind_param("s", $searchTerm);

// Execute the query
$stmt->execute();

// Fetch the results
$result = $stmt->get_result();

// Process the results as needed

Keywords

wildcards LIKE queries PHP SQL best practices

Related Questions