Prepare statement for search?

Question

PHP

Hello.
I'm doing a search, and I thought if I'm doing it right, in terms of protection against sql injections.
I make a request like this:

SELECT r.*, u.nickname AS 'u_name', t.taste, t.recept_id 
FROM recept AS r 
LEFT JOIN users AS u ON u.id = r.user_id 
LEFT JOIN tastes AS t ON t.recept_id = r.id 
WHERE r.name LIKE '%ppl%' AND t.taste LIKE '%дк%'

"ppl" and "dk" -> came from the user via _GET .
Moreover, there is no parameter bind or any real protection ..
The question itself is, is protection actually needed here?
What can I do if I leave such a request?
Thanks

Answer 1

User input can never be trusted!
Read https://habrahabr.ru/post/148151/

Answer 2

Definitely Prepare statements for search!