What best practice should be followed when using a WHERE LIKE query in PHP to avoid errors?

When using a WHERE LIKE query in PHP, it is important to properly escape special characters in the search term to avoid SQL injection vulnerabilities and errors. This can be achieved by using the mysqli_real_escape_string function to sanitize the input before constructing the query. 

// Assuming $searchTerm contains the search term input by the user
$searchTerm = mysqli_real_escape_string($connection, $searchTerm);

$query = "SELECT * FROM table_name WHERE column_name LIKE '%$searchTerm%'";
$result = mysqli_query($connection, $query);

// Process the query result here

Keywords

PHP WHERE LIKE query SQL injection prepared statements data sanitization

Related Questions