MySQL Like查询中的PHP字符串变量

Question

so I'm attempting to take in a PHP variable and do insert it into a simple sql query, but it's not working and I can't seem to figure out the issue.

NOTE: I know this code has security issues

staff_model.php file:

function getSearches($searchterm) {
        $sql = "SELECT * 
                FROM people 
                WHERE name 
                LIKE '%{$searchterm}%'";
        $query = $this->db->query($sql);
        return $query;
    }

My table has several columns but it has columns like id, name, subject, type. The way I get $searchterm is something like

var searchText = document.getElementById('custom-search-text').value; 

in my javascript file and I'll pass it to users.php through

$.get(url+"/api/users/staff", {id: id, name: name, type: type, subject: subject, search: searchText})

Just to make sure everything else was working correctly, I hardcoded something for searchTerm (so something like $sql = "SELECT * FROM people WHERE name LIKE 'Matt'" ) and I did get the correct results.

Something else I tried was $sql = "SELECT * FROM people WHERE name LIKE $searchTerm" and this didn't work.

Any ideas on how I can get it to work with wildcards?

Answer 1

怎么样“ SELECT * FROM像“％”这样的人。$ searchterm。“％'”；

Answer 2

Try this $sql = "SELECT * FROM people WHERE name LIKE '%".$searchterm."%'";

using . as concatenating operator