Question

$username_decoded = '<i>marco</i>';
$stmt = $this->db->prepare("SELECT * FROM foo WHERE username=:username");
$stmt->bindParam(':username',$username_decoded,PDO::PARAM_STR);
$stmt->execute();

$all_fetched = $stmt->fetchAll(PDO::FETCH_NUM);

print_r($all_fetched);

The code above gives me empty array. That username exists in the db. What’s wrong with it?

Answer 1

I’m betting the type of the username column is CHAR(n) and not VARCHAR(n). CHAR(n) adds spaces to the end of the string to pad it to fit the width of the column. Change your column to VARCHAR(n) and make sure to trim all of the excess spaces afterwards.

Otherwise, if you can’t change the column, you can either use str_pad($username_decoded, length of column) before comparing it against the database, or use TRIM(username) in your query.