79442362

Date: 2025-02-15 23:11:07
Score: 1
Natty:
Report link

I know this is an old post and I have 0 rep. So here is my CRITICAL comment on using the $type = "$type%": When using like in mysql queries you need to escape the $type first, otherwise foul people can insert the special match patterns (+%_) themselves, use addcslashes() so line should be

$type = addcslashes($type, '+%_') . '%'

then your code won't do unexpected things like return the entire database when someone types %a into the search box which in example code would become %a% and using code above \%a% and probable have no match. See https://www.php.net/manual/en/function.addcslashes.php and https://mariadb.com/kb/en/like/

Reasons:
  • Long answer (-0.5):
  • No code block (0.5):
  • Low reputation (1):
Posted by: Matthew S