MySQL Injection by LIKE operator [duplicate]

Answer 1

Any operator can be injected without binding.

$_POST['search'] = "1%'; DROP TABLE myTable LIKE '%";

Would make

.... AND tags,title,text LIKE '%1%'; DROP TABLE myTable LIKE '%%'

Read on how to bind parameters.