I am trying to replace :search when the query is executed but it does not seem to be replaced

Question

After reviewing this SO, I am having some trouble using prepared statements.

I have added the following to my db connection:

$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

And here are my query statements:

$query = "SELECT schedules.schedule_name, users.name, schedules.schedule_id
    FROM schedules
    INNER JOIN users
    ON schedules.admin_id=users.user_id
    WHERE schedules.schedule_name
    LIKE '%:search%'
    ORDER BY schedules.schedule_name";
    $stmt   = $db->prepare($query);
    $result = $stmt->execute(array('search' => $search_string));
    $search_results = $stmt->fetchAll();

As you can see in the LIKE, I am trying to replace :search when the query is executed but it does not seem to be replaced.

Vague titles like the one you want are troublesome for Google searchers, who have to sift through questions like these that have nothing to do with what they're searching for. — Robert Harvey, Feb 25 '14 at 16:20
It is not about next time. It is about finding an answer to your question. Current one. — Your Common Sense, Feb 25 '14 at 16:22
*All right,* also you can do it this way: http://stackoverflow.com/search?q=pdo+prepared+statement+like — Your Common Sense, Feb 25 '14 at 16:28

score 0 · Accepted Answer · answered Feb 25 '14 at 16:30

When you do a parameterized query, it is not simply a string replace, and you don't surround it with singlequotes:

$query = "SELECT schedules.schedule_name, users.name, schedules.schedule_id
    FROM schedules
    INNER JOIN users
    ON schedules.admin_id=users.user_id
    WHERE schedules.schedule_name
    LIKE :search
    ORDER BY schedules.schedule_name";

But you want to have % wildcards around the term right? Add them when you inject it:

$result = $stmt->execute(array('search' => '%' . $search_string . '%' ));

I am trying to replace :search when the query is executed but it does not seem to be replaced

1 Answers1