What are the potential pitfalls of using wildcards in SQL queries when filtering data in PHP?

Using wildcards in SQL queries when filtering data in PHP can potentially lead to SQL injection attacks if the input is not properly sanitized. To prevent this, it's important to use prepared statements with parameterized queries to ensure that user input is treated as data rather than executable SQL code. 

// Using prepared statements to prevent SQL injection when using wildcards in SQL queries

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// User input
$searchTerm = $_GET['search'];

// Prepare a SQL statement with a wildcard
$stmt = $pdo->prepare("SELECT * FROM mytable WHERE column LIKE :searchTerm");

// Bind the wildcard parameter
$stmt->bindParam(':searchTerm', $searchTerm, PDO::PARAM_STR);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Output the results
foreach ($results as $row) {
    echo $row['column'] . "<br>";
}

Keywords

wildcards SQL queries filtering data PHP pitfalls

Related Questions