How to use prepare for query having LIKE clause Ask

PHP
1

please see the below code this works fine with mysqli method but prone to sql injection so i want to use prepare but for LIKE i cant use it

   $t=strtolower($_POST['e']);
    $search_exploded = explode ( " ", $t );
    $construct = '';
    foreach( $search_exploded as $search_each ) { 
    $construct .="AND title LIKE ? "; 
     }


    $query=$conn->prepare( "SELECT * FROM vdo WHERE 1 $construct ");
    $query->execute(["%$search_each%"]);
     $found=$query->rowCount();
     if($found == 0){
     echo "NO Result Found"; 

    }else{
     while($row_id1=$query->fetch(PDO::FETCH_ASSOC)){
     echo $title=$row_id1['title']; 

      }
2

<off-topic>
@engg08082 when you post code in the forum, you need to format it. To do so you can either select all the code and click the </> button, or type 3 backticks ``` on a separate line both before and after the code block.
</off-topic>

3

The problem you have there is that you’re only supplying one parameter to the query, regardless of how many parameters you actually create in the query. And, the one parameter you do supply doesn’t exist by the time you actually get to using it - it only has scope within your foreach() loop.

I would suggest that you build an array based on your $search_exploded array, or just use that array and add the leading and trailing % symbols to each element.

5

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.