Using Like in the query and SQL Injection implications

Asked May 02 '20 at 07:33

Active May 02 '20 at 07:33

Viewed 41 times

I know this question must have been asked most often.

But I just want to know if this code can protect me from sql injection attack as percent is quoted in single. Am just worried in case of any possible attack

Can someone throws more light on this LIKE QUERY, or if there is any other better way thanks

$s =$_POST['data'];

include(pdo.php);
$stmt = $db->prepare('SELECT * FROM users where name like :name OR country like :country limit 6');
$stmt->execute(array(
':name' => '%'.$s.'%',
':country' => '%'.$s.'%'
));

while ($row = $stmt->fetch()){
//
}

asked May 02 '20 at 07:33

Nancy Moore

2,322
2
21
38

1

Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Progman May 02 '20 at 07:54
1

You're using a prepared statement, that's the important bit, then the percentage characters in the values don't matter. – KIKO Software May 02 '20 at 08:09
Thanks all. am good to go now – Nancy Moore May 02 '20 at 11:35

Using Like in the query and SQL Injection implications

0 Answers0