how to handel % in post method in php [closed] - php

Question

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 2 years ago.
Improve this question
Im send a mysql query in php variable using post method having % value;
$Brand= 'SELECT BRAND_CODE FROM product WHERE STATUS='1' AND UNIT_CODE like '%"81"%'';
$Brand=$_POST['Brand'];
echo $Brand;
and result is
SELECT BRAND_CODE FROM product WHERE STATUS='1' AND UNIT_CODE like '%
How can I get the complete string using this

Answer 1

$Brand= "SELECT BRAND_CODE FROM product WHERE STATUS='1' AND UNIT_CODE like '%81%'";
$Brand=$_POST['Brand'];
echo $Brand;
And the result will be like:
SELECT BRAND_CODE FROM product WHERE STATUS='1' AND UNIT_CODE like '%81%'

Answer 2

You should be using a prepared statement any time variables are involved and especially when they come from $_GET/$_POST requests to avoid MySQL injection.
Although your request isn't super-clear I'm taking a stab in the dark and assuming that you're trying to at least run a different or modified version of that query based on some sort of user interaction - while I haven't tested the below code it should serve as a good starting point for how you can modify queries safely using prepared statements and PDO.
You can view the following link for reference https://phpdelusions.net/pdo
<?php
// Configure the below based on your DB
$host = '127.0.0.1';
$db = 'test';
$user = 'root';
$pass = '';
$charset = 'utf8mb4';
$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
// Leave this as-is
$options = [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
PDO::ATTR_EMULATE_PREPARES => false,
];
// Attempt connection here accessed via $pdo below
try {
$pdo = new PDO($dsn, $user, $pass, $options);
} catch (\PDOException $e) {
throw new \PDOException($e->getMessage(), (int)$e->getCode());
}
// Get your brand variable from post request
$brand = "%{$_POST['Brand']}%";
// Prepare an SQL statement with your status and brand variables
$stmt = $pdo->prepare("SELECT BRAND_CODE FROM product WHERE status = ? AND UNIT_CODE LIKE ?");
// Execute the above statement, bind variables here to avoid MySQL injection
$stmt->execute([ 1, $brand ]);
// Retrieve your results (if any)
$results = $stmt->fetchAll();
// Clean up, checks and do what you will with the results..