What is the best way to use wildcards like % in a PHP database query?

When using wildcards like % in a PHP database query, it is important to properly escape and sanitize user input to prevent SQL injection attacks. One way to do this is by using prepared statements with placeholders for the wildcard characters. This allows you to safely insert user input into the query without risking SQL injection vulnerabilities. 

// Assuming $searchTerm is the user input with wildcards
$searchTerm = '%' . $searchTerm . '%';

// Prepare a SQL statement with a placeholder for the wildcard characters
$stmt = $pdo->prepare("SELECT * FROM table WHERE column LIKE :searchTerm");

// Bind the wildcard search term to the placeholder
$stmt->bindParam(':searchTerm', $searchTerm, PDO::PARAM_STR);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

PHP wildcards database query LIKE operator SQL injection

Related Questions