mysql like query

Question

How do I combine a LIKE query with bind_param,? I tried:

%?%

But I'm doing it wrong and I can't find any reference.

audiodude · Accepted Answer · 2011-03-07 18:35:11Z

4

select * from your_table where your_column like concat('%', ?, '%');

and bind the ? to your input value

The naive approach:

select * from your_table where your_column like ?;
$your_input='%'.$your_input.'%';

is vulnerable to SQL Injection and should not be used.

audiodude

2,87025 silver badges27 bronze badges

answered Dec 25, 2010 at 3:42

ajreal

47.4k11 gold badges98 silver badges119 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

You could also put the % around the value that you're binding.

Beware SQL Injection with the second one. If $your_input contains 'x%' OR 1 = 1 --', the query does not perform as you expect.

lucky me its not via input it's a category view and its all preseted