24

I've read multiple examples on how these queries should be written but I'm struggling to get this specific like to run when using bindParam

Would this be the correct way to match usernames that begin with a?

$term = "a";
$term = "'$term%'";

$sql = "SELECT username 
        FROM `user` 
        WHERE username LIKE :term 
        LIMIT 10";      

$core = Connect::getInstance();

$stmt = $core->dbh->prepare($sql);
$stmt->bindParam(':term', $term, PDO::PARAM_STR);
$stmt->execute();
$data = $stmt->fetchAll();
Dan
  • 11,914
  • 14
  • 49
  • 112

2 Answers2

33

No, you don't need the inner single quotes so just $term = "$term%";

The statement you're running now would try to match 'a%' instead of a%

bindParam will make sure that all string data is automatically properly quoted when given to the SQL statement.

Harald Brinkhof
  • 4,375
  • 1
  • 22
  • 32
5

You can use bindValue , suppose you are having a $query = "search string"

$stmt->bindValue(':term', $query.'%'); // this will do like search for "search term XXXXX"

similarly

$stmt->bindValue(':term', '%'.$query.'%');

or

$stmt->bindValue(':term', '%'.$query);
Dip
  • 646
  • 6
  • 8