MySQL LIKE + php sprintf

Question

$test = sprintf(\"SELECT * FROM `table` WHERE `text` LIKE \'%%s%\'\", mysql_real_escape_string(\'test\'));

echo $test;

output:

SELECT          


        

Answer 1

You’re jumbling contexts. For consistency, put the things that aren't inside the SQL single quotes outside of the sprintf() format string:

$test = sprintf(
          "SELECT * FROM `table` WHERE"
            . "`xt` LIKE '%s'",
          "%" . mysql_real_escape_string("test") . "%"
        );