What potential issues can arise when using the LIKE operator in a MySQL query with PHP?

When using the LIKE operator in a MySQL query with PHP, a potential issue that can arise is SQL injection if the input is not properly sanitized. To prevent this, you should always use prepared statements with parameterized queries to securely pass user input to the database. 

// Using prepared statements to prevent SQL injection when using the LIKE operator in a MySQL query with PHP

// Assuming $searchTerm is the user input
$searchTerm = $_POST['searchTerm'];

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM mytable WHERE column_name LIKE :searchTerm");

// Bind the search term to the parameter
$stmt->bindValue(':searchTerm', '%' . $searchTerm . '%', PDO::PARAM_STR);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

// Loop through the results and do something with them
foreach ($results as $row) {
    // Do something with $row
}

Keywords

MySQL LIKE operator PHP SQL injection performance.

Related Questions