What potential pitfalls should be considered when using LIKE in a prepared statement in PHP?

When using the LIKE operator in a prepared statement in PHP, it's important to be cautious of SQL injection attacks. To prevent this, you should properly escape any user input before using it in the LIKE clause. One way to do this is by using the PDO::quote() method to escape the input. 

// Assuming $searchTerm is the user input to be used in the LIKE clause
$searchTerm = $_POST['searchTerm'];

// Connect to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a statement with a placeholder for the search term
$stmt = $pdo->prepare("SELECT * FROM table WHERE column LIKE :searchTerm");

// Bind the escaped search term to the placeholder
$searchTerm = $pdo->quote('%' . $searchTerm . '%');
$stmt->bindParam(':searchTerm', $searchTerm, PDO::PARAM_STR);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Do something with the results
foreach ($results as $result) {
    // Output or process the result
}

Keywords

LIKE prepared statement SQL injection security escaping

Related Questions