SQL參數化查詢LIKE'％？ ％'PHP

Question

我在php中有一個搜索功能，並使用參數化查詢來創建它，以確保它的安全。

$words = $_POST['words']//words is the form that has the words submitted by the user 
$array = explode(',', $words); 
$con = mysqli_connect("localhost","user","pass","database"); 

$stmt = $con->prepare(" SELECT column_name FROM table WHERE column_name LIKE ?") 
foreach($array as $key) { //searches each word and displays results 
    $stmt->bind_param('s', $key) 
    $stmt->execute(); 
    $result = $stmt->get-result(); 

    while($row = $result->fetch_assoc(){ 
    echo $row["column_name"] 
    } 
} 

但是我想$ stmt是聲明是

$stmt = $con->prepare(" SELECT column_name FROM table WHERE column_name LIKE '%?%' ") 

否則人們必須鍵入列名的整個價值找到它。

Answer 1

您可以使用CONCAT()，像這樣：

LIKE CONCAT ('%', ?, '%') 

Answer 2

你可以做到這一點，如下所示：

$key="%$key%" 

然後綁定$關鍵。

另見PHP Binding a Wildcard的幾乎同樣的問題....