MySQL LIKE clause with numbers fails because of PHP

Question

I'm experiencing unexpected results from a query when using numbers as pattern. The query looks like this:

SELECT Code FROM table WHERE Code LIKE '%xxx%'

Everything is fine when xxx are letters, but when they are numbers the query returned by the remote PHP is wrong. It seems as if the starting %nn is interpreted as an ASCII code.

Example:

SELECT Code FROM table WHERE Code LIKE '%26F%'

is returned as: SELECT Code FROM table WHERE Code LIKE '&F%'

Javascript code sample:

find = "26F";
srch = "Code LIKE '%" + find + "%'";
url: "load_searched_record.php?target="+srch;
...

PHP simplified code:

$target = $_GET['target'];
echo $target;

Since I removed all the MySql code for testing, leaving only the above 2 rows, it is quite evident that the problem in originated from PHP, but why?
Should I encode in same way the query? If yes, how? Thanks

Pls note that the PHP file is UTF-8 encoded.

You probably need to encode your srch parameter in your url. The %## is being interpreted as a hex code for a character in the url — snow_FFFFFF, Oct 05 '15 at 21:04
https://perishablepress.com/stop-using-unsafe-characters-in-urls/ — Danijel, Oct 05 '15 at 21:05
It seems like you use unvalidated user input as part of a MySQL query. Please read: http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Fabian Schmengler, Oct 05 '15 at 21:14

score 7 · Accepted Answer · answered Oct 05 '15 at 21:04

That’s because you failed to URL-encode the values you are putting into the query string properly … (and that is not PHP’s fault.)

You need to use encodeURIComponent on the value, before you append it to the URL:

"load_searched_record.php?target="+encodeURIComponent(srch)

MySQL LIKE clause with numbers fails because of PHP

1 Answers1