LIKE query using multiple keywords from search field using PDO prepared statement

Question

Site users use a search form to query a database of products. The keywords entered search the titles for the products in the database.

    public function st         


        

Answer 1

Prepared statements protect you from sql injection, so sql code in the parameters will not be interpreted. You will have to build a sql query with the correct number of AND itemTitle LIKE ? before calling prepare().

  $keywords = preg_split('/[\s]+/', $keywords);
  $totalKeywords = count($keywords);
  $query = "SELECT * FROM prodsTable WHERE itemTitle LIKE ?";

  for($i=1 ; $i < $totalKeywords; $i++){
    $query .= " AND itemTitle LIKE ? ";
  }

  $sql=$this->db->prepare($query);
  foreach($keywords as $key => $keyword){
    $sql->bindParam($key+1, '%'.$keyword.'%');
  }
  $sql->execute ();