How to Safely Use Parameterized LIKE Queries with PDO?

Parameterized LIKE Queries with PDO

When creating a LIKE statement with PDO, it's essential to use parameterized queries to prevent SQL injection attacks. This article demonstrates how to construct such queries effectively.

As noted in the initial query attempt, the wildcard (%) should be appended to the parameter placeholder. This can be achieved by using the following code:

$query = $database->prepare('SELECT * FROM table WHERE column LIKE ?');
$query->execute(array('value%'));

This query safely searches for values in the 'column' field that start with 'value'. The wildcard ensures that the search includes results containing additional characters after 'value'.

By using parameterized queries, you protect your application from potential attacks and maintain the integrity of your data.

The above is the detailed content of How to Safely Use Parameterized LIKE Queries with PDO?. For more information, please follow other related articles on the PHP Chinese website!