SQL参数化查询LIKE'％？ ％'PHP

Question

我在php中有一个搜索功能，并使用参数化查询来创建它，以确保它的安全。

$words = $_POST['words']//words is the form that has the words submitted by the user 
$array = explode(',', $words); 
$con = mysqli_connect("localhost","user","pass","database"); 

$stmt = $con->prepare(" SELECT column_name FROM table WHERE column_name LIKE ?") 
foreach($array as $key) { //searches each word and displays results 
    $stmt->bind_param('s', $key) 
    $stmt->execute(); 
    $result = $stmt->get-result(); 

    while($row = $result->fetch_assoc(){ 
    echo $row["column_name"] 
    } 
} 

但是我想$ stmt是声明是

$stmt = $con->prepare(" SELECT column_name FROM table WHERE column_name LIKE '%?%' ") 

否则人们必须键入列名的整个价值找到它。

Answer 1

您可以使用CONCAT()，像这样：

LIKE CONCAT ('%', ?, '%') 

Answer 2

你可以做到这一点，如下所示：

$key="%$key%" 

然后绑定$关键。

另见PHP Binding a Wildcard的几乎同样的问题....