What are some common pitfalls when constructing a search query in PHP that may result in duplicate data being returned?

One common pitfall when constructing a search query in PHP is not properly sanitizing input data, which can lead to duplicate data being returned if the search term is not formatted correctly. To solve this issue, it is important to use prepared statements and bind parameters to prevent SQL injection attacks and ensure that the search query is executed correctly. 

// Example of constructing a search query in PHP with proper input sanitization

// Assuming $searchTerm is the input search term
$searchTerm = $_POST['searchTerm'];

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare the search query with a placeholder for the search term
$stmt = $pdo->prepare("SELECT * FROM mytable WHERE column_name LIKE :searchTerm");

// Bind the search term to the placeholder and execute the query
$stmt->bindParam(':searchTerm', $searchTerm, PDO::PARAM_STR);
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Display the results
foreach ($results as $row) {
    echo $row['column_name'] . "<br>";
}

Keywords

SQL injection DISTINCT keyword GROUP BY clause array_unique function JOIN statement

Related Questions