MySQL Injection by LIKE operator
mysql, php, sql-injection
Solution
Any operator can be injected without binding.
$_POST['search'] = "1%'; DROP TABLE myTable LIKE '%";
Would make
.... AND tags,title,text LIKE '%1%'; DROP TABLE myTable LIKE '%%'
Read on how to bind parameters.
Problem
I've below code in one of my php files to fetch data from DB: ``` $products = $this->db->get_rows('SELECT * from products WHERE shop_id='.$_SESSION['shop_id'].'AND tags,title,text LIKE \'%'.$_POST['search'].'%\''); ``` Is it problematic? I mean LIKE operator can be injected? Edited please provide examples of injecting in this way