What are the potential risks of using LIKE in a MySQL query in PHP?

Using the LIKE operator in a MySQL query in PHP can potentially lead to SQL injection attacks if user input is not properly sanitized. To mitigate this risk, it is important to use prepared statements with placeholders when constructing SQL queries to prevent malicious input from being executed as SQL code. 

// Example of using prepared statements with placeholders to prevent SQL injection
$search_term = $_POST['search_term'];

// Prepare a SQL statement with a placeholder
$stmt = $pdo->prepare("SELECT * FROM table_name WHERE column_name LIKE :search_term");

// Bind the search term to the placeholder and execute the statement
$stmt->execute(['search_term' => '%' . $search_term . '%']);

// Fetch the results
$results = $stmt->fetchAll();

Keywords

MySQL LIKE query risks PHP

Related Questions