0

Hi I’m trying to make the following prepared statement to work can anybody help me please? I know how to do it without the symbol % but in this case I need it to perform a search

$sql = "SELECT user_first, user_last, user_email, user_id ";
        $sql.=" FROM users";
        $sql.=" WHERE ( user_first LIKE ?% ";
        $sql.=" OR user_last LIKE ?% ";
        $sql.=" OR user_email LIKE ?% )";
        $sql.=" AND user_role='partner'";


        $query= mysqli_stmt_prepare($conn, $sql);
        mysqli_stmt_bind_param($query, 'sss', $requestData['search']['value'], $requestData['search']['value'], $requestData['search']['value']  );
        mysqli_stmt_execute($query);
        mysqli_stmt_store_result($query);
        $totalFiltered = mysqli_stmt_num_rows($query);
pippo
  • 183
  • 1
  • 5
  • 18
  • That does not look like a good prepared statement - why are you using only one `%`? – Nico Haase Feb 19 '18 at 21:02
  • Possible duplicate of [php mysqli prepared statement LIKE](https://stackoverflow.com/q/18527659/1255289) – miken32 Feb 19 '18 at 21:04
  • If you look at other questions about prepared statements and connecting them to a `LIKE`, the users add the `%` to the parameters they input - will that help? – Nico Haase Feb 19 '18 at 21:04
  • The answer to this one is literally in the php manual comments: https://secure.php.net/manual/mysqli-stmt.bind-param.php#102048 – Cobra_Fast Feb 19 '18 at 21:07

0 Answers0