What is the right way to escape text that is passed to query with LIKE pattern matching? The problem is that
select()->where('field LIKE ?', $input . '%');
will be incorrect with
$input = '%sometext';
UPDATED: 'vulnerable to' -> '开发者_高级运维incorrect with'
It's not vulnerability, is it? It's valid content. If it poses vulnerability to your application (like WHERE user LIKE '%admin%'
) you should consider validating/filtering the input yourselves using sth like:
if (strpos('%', $input)){
$input = strtr($input, '%', '');
}
精彩评论