0

I am trying to do a small search engine for a website.

This is the simple code

if ( Input::issetGet('q') ) {

        $q = Input::get('q');

        if ( !empty($q) ) {

            $keywords = explode(' ', $q);

            $findPhones = $dbh->prepare("
                SELECT 
                    p.id AS pId, p.name AS pName, p.original_price, p.price, p.img, p.brand, p.model, p.color, p.o_s, p.status, p.description,
                    b.id, b.name AS bName, 
                    m.id, m.name AS mName
                FROM phones AS p
                LEFT JOIN brands AS b ON p.brand = b.id
                LEFT JOIN phone_models AS m ON p.model = m.id
                WHERE p.name LIKE '%" . implode("%' OR p.name LIKE '%", $keywords) . "%'  
                OR p.description LIKE '%" . implode("%' OR p.description LIKE '%", $keywords) . "%' 
                OR b.name LIKE '%" . implode("%' OR b.name LIKE '%", $keywords) . "%'  
                ORDER BY p.id DESC
            ");
            $findPhones->execute();
            $phones = $findPhones->fetchAll();

        }
    }

Let me quickly explain. If I search for samsung, this query will check if the p.name, p.description or b.name contain this word. If I search for samsung computers the query will check if p.name, p.description or b.name contain either the word samsung or computers and so on for more search terms.

The problem is that I can't find a way to bind $keywords, I would like not to hardcode it like in the query, but to pass it when I execute the query.

I tried with ? and :keyword, but none worked. If I dump the query, the LIKE statements are empty, "".

My guess is that the problem lays in the implode function which is inside the query, it won't allow me to parameterize the array $keywords.

At this point I simply query the database without binding values and I am open for SQL Injection.

Q: How can I bind the array keywords, and if not possible, what's the best way to protect from SQL Injection in this case ?

Thank you

C. Ovidiu
  • 1,104
  • 2
  • 18
  • 38
  • Check that question: http://stackoverflow.com/questions/920353/php-pdo-can-i-bind-an-array-to-an-in-condition – parnas Nov 24 '13 at 10:07
  • http://stackoverflow.com/questions/15990857/reference-frequently-asked-questions-about-pdo – Your Common Sense Nov 24 '13 at 10:08
  • Thank you for replying, but both those questions hard code the variables into the query, I want to bind them – C. Ovidiu Nov 24 '13 at 10:22
  • Not in my example, check the accepted answer. – parnas Nov 24 '13 at 10:42
  • @YourCommonSense wins for being the most helpful person on StackOverflow, and I totally mean that sarcastically. – Zarathuztra Dec 07 '13 at 21:46
  • OP, try using the "in" statement instead of a bunch of ORs. That'll allow you to pass in a comma delineated set to compare against, unless I'm misunderstanding your question in some way. – Zarathuztra Dec 07 '13 at 21:47

0 Answers0