php building a mySQL query with a wildcard

Question

Cant seem to figure out whats wrong, the query should be correct, and it works in phpMyAdmin but when I introduce a wildcard into the php string "%", every query fails.

This works:

$query = sprintf("SELECT `id`FROM `table`WHERE `name` LIKE '".$resources[1]."'", 
                                                                   mysql_real_escape_string($resources[1]));

This does not:

$query = sprintf("SELECT `id`FROM `table`WHERE `name` LIKE '%".$resources[1]."%'", 
                                                                   mysql_real_escape_string($resources[1]));

The query Im obviously trying to generate is

SELECT `id` FROM `table`WHERE `name` LIKE '%someName%'

What does echo $query; tell you? Can you make an example of that kind of value you are searching? Don't forget that a leading % requires that there be something in front of the value, so searching for %Michael% will not give you MichaelTaylor — Pekka
– Pekka, Commented Feb 14, 2013 at 18:36
it doesnt generate at all when I introduce the wildcard, without the wildcard it generates as it should — MichaelTaylor3D
– MichaelTaylor3D, Commented Feb 14, 2013 at 18:36
You mean $query is empty in the second example? That seems unlikely. — Pekka
– Pekka, Commented Feb 14, 2013 at 18:37
I agree with you but that is what is happening, and the only difference is when I introduce the wildcard, when the wildcard is absent, echo $query comes out as it should — MichaelTaylor3D
– MichaelTaylor3D, Commented Feb 14, 2013 at 18:39

Marc B · Accepted Answer · 2013-02-14 18:36:43Z

2

Read the sprintf man page: http://php.net/sprintf

$sql = sprintf('..... '%%%s%%', $var);
                       ^^--- turns into %
                         ^--  %s -> $var
                           ^^-- turns into %

Your code, as written, does NOTHING to prevent sql injection, since you're not using sprintf() properly.

answered Feb 14, 2013 at 18:36

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

MichaelTaylor3D Over a year ago

SQL injection is already protected against elsewhere in the code, that isnt what I was asking about.

MichaelTaylor3D Over a year ago

However you are correct that I wasnt using sprintf properly and that was what was causing the problem

Collectives™ on Stack Overflow

php building a mySQL query with a wildcard

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related