$a=$_GET["a"]; $b=$_GET["b"]; $a=str_replace("%", "\%", $a); $b=str_replace("%", "\%", $b); $sql="SELECT * FROM table "; $sql.="WHERE ColA LIKE :txtA AND ColB LIKE :txtB"; $query = $db->prepare($sql); $query->bindValue(':txtA', '%'.$a.'%', PDO::PARAM_STR); $query->bindValue(':txtB', '%'.$b.'%', PDO::PARAM_STR); $query->execute();
I want to give user ability to search anything. Should I filter more characters? Will it be 100% safe and work as it should do for searching pieces of text in database?
Edit: ColA and ColB are strings, just text (phrase and tags in search engine)