Answer the question
In order to leave comments, you need to log in
What does the author mean in this paragraph?
Hello! I am reading a book by David Sklyar in English. Came to the database. I have re-read this paragraph several times, but I do not quite understand the author. What does he mean? What will happen if you use placeholder (substitution symbol, if in Russian) in this situation?
Here is the paragraph itself
// First, do normal quoting of the value
$dish = $db->quote($_POST['dish_search']);
// Then, put backslashes before underscores and percent signs
$dish = strtr($dish, array('_' => '\_', '%' => '\%'));
// Now, $dish is sanitized and can be interpolated right into the query
$stmt = $db->query("SELECT dish_name, price FROM dishes
WHERE dish_name LIKE $dish");
Answer the question
In order to leave comments, you need to log in
If you need to escape wildcards (%, _) in the string for LIKE, you won't be able to use the placeholder, because quoting, performed when substituting into a placeholder, knocks down the escaping of wildcards:
Those. the percentages escaped via strtr turned into full-fledged wildcards again.
To prevent wildcard escaping from crashing, quoting must come before strtr(). Therefore, we remove the placeholder and manually execute quote().
What does the author mean in this paragraph?Here is for MS SQL LIKE , read about escape_character.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question