note 108397 added to pdostatement.bindparam

when using PDO bindParam to do a search with a LIKE condition, you can prevent user from using LIKE wildcards ("%" and "_"), by escape them to literal using addcslashes or strtr function. Example: <? $query = "SELECT * FROM users WHERE firstname LIKE :keyword"; $statement = $handler->prepare($query); // Bind the parameter $statement->bindParam(':keyword', $keyword); // escape LIKE wildcards ("%" and "_") from user input // using strtr() $keyword = strtr($keyword, array('\\' => '\\\\', '%' => '\%', '_' => '\_') ); // or using addcslashes() // $keyword = addcslashes($keyword, '%_'); // add your own LIKE wildcards $keyword = '%' . $keyword . '%'; $statement->execute(); // notes: backslash is escape twice, once at SQL quoted string, another at LIKE wildcards string // so, backslash from bindParam() will not affect backslash from strtr() or addcslashes() ?> ---- Server IP: 192.41.42.26 Probable Submitter: 60.53.120.50 ---- Manual Page -- http://www.php.net/manual/en/pdostatement.bindparam.php Edit -- https://master.php.net/note/edit/108397 Del: integrated -- https://master.php.net/note/delete/108397/integrated Del: useless -- https://master.php.net/note/delete/108397/useless Del: bad code -- https://master.php.net/note/delete/108397/bad+code Del: spam -- https://master.php.net/note/delete/108397/spam Del: non-english -- https://master.php.net/note/delete/108397/non-english Del: in docs -- https://master.php.net/note/delete/108397/in+docs Del: other reasons-- https://master.php.net/note/delete/108397 Reject -- https://master.php.net/note/reject/108397 Search -- https://master.php.net/manage/user-notes.php