note 108397 modified in pdostatement.bindparam by salathe
| From: | salathe@php.net | Date: | Mon, 23 Apr 2012 13:16:36 +0000 |
| Subject: | note 108397 modified in pdostatement.bindparam by salathe | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-187301@lists.php.net to get a copy of this message | ||
when using PDO bindParam to do a search with a LIKE condition, you can prevent user from using LIKE
wildcards ("%" and "_"), by escape them to literal using addcslashes
or strtr
function. Example: <?php $query
= "SELECT * FROM
users WHERE firstname LIKE
:keyword"; $statement =
$handler->prepare($query); // Bind the
parameter $statement->bindParam(':keyword',
$keyword); // escape LIKE wildcards ("%" and
"_") from user input // using strtr() $keyword =
strtr($keyword, array('\\' => '\\\\', '%'
=> '\%', '_' => '\_')
); // or using addcslashes() // $keyword = addcslashes($keyword,
'%_'); // add your own LIKE
wildcards $keyword = '%' . $keyword .
'%'; $statement->execute(); //
notes: backslash is escape twice, once at SQL quoted string, another at LIKE wildcards
string // so, backslash from bindParam() will not affect backslash from strtr() or
addcslashes() ?>
--was--
when using PDO bindParam to do a search with a LIKE condition, you can prevent user from using LIKE
wildcards ("%" and "_"), by escape them to literal using addcslashes or strtr
function.
Example:
<?
$query = "SELECT * FROM users WHERE firstname LIKE :keyword";
$statement = $handler->prepare($query);
// Bind the parameter
$statement->bindParam(':keyword', $keyword);
// escape LIKE wildcards ("%" and "_") from user input
// using strtr()
$keyword = strtr($keyword, array('\\' => '\\\\', '%' =>
'\%', '_' => '\_') );
// or using addcslashes()
// $keyword = addcslashes($keyword, '%_');
// add your own LIKE wildcards
$keyword = '%' . $keyword . '%';
$statement->execute();
// notes: backslash is escape twice, once at SQL quoted string, another at LIKE wildcards string
// so, backslash from bindParam() will not affect backslash from strtr() or addcslashes()
?>
http://php.net/manual/en/pdostatement.bindparam.php