Question

I want to query my MySQL database using prepared statements. The query should look like:

SELECT name, idname FROM names WHERE origin='english' AND name like('%a%')"

This one works great:

$origin = "english";
$stmt = $mysqli->prepare("SELECT name, idname FROM names WHERE origin=? AND name like('%a%')"))
$stmt->bind_param("s", $origin);

But this doesn’t work at all (even without an error):

$origin = "english";
$letter = "a";
$stmt = $mysqli->prepare("SELECT name, idname FROM names WHERE origin=? AND name like(%?%)")) 
$stmt->bind_param("ss", $origin, $letter);

Please mind the last term like. I don’t know how to bind the second parameter letter.

Answer 1

Pass the value to LIKE predicate using the CONCAT statement.

Corrected version:

$origin = "english";
$letter = "a";
$stmt = $mysqli->prepare("SELECT name, idname FROM names WHERE origin=? 
AND name LIKE CONCAT('%',?,'%')")) 
$stmt->bind_param("ss", $origin, $letter);