note 108397 deleted from pdostatement.bindparam by salathe

Note Submitter: Anonymous ---- when using PDO bindParam to do a search with a LIKE condition, you can prevent user from using LIKE wildcards ("%" and "_"), by escape them to literal using addcslashes or strtr function.

Example:
<?php
$query = "SELECT * FROM users WHERE firstname LIKE :keyword";
$statement = $handler->prepare($query);

// Bind the parameter
$statement->bindParam(':keyword', $keyword);

// escape LIKE wildcards ("%" and "_") from user input
// using strtr()
$keyword = strtr($keyword, array('\\' => '\\\\', '%' => '\%', '_' => '\_') );
// or using addcslashes()
// $keyword = addcslashes($keyword, '%_');

// add your own LIKE wildcards
$keyword = '%' . $keyword . '%';

$statement->execute();
// notes: backslash is escape twice, once at SQL quoted string, another at LIKE wildcards string
// so, backslash from bindParam() will not affect backslash from strtr() or addcslashes()
?>