SQL injection · Question 11 of 12
A guestbook searches with $sql = "... WHERE bodytext LIKE '%" . $q . "%'". Which correction is complete?
1 answer is correct. Hard
Show answer
Answer
- B QueryBuilder with escapeLikeWildcards() and a parameter
Explanation
The value is bound with createNamedParameter(), and escapeLikeWildcards() prevents % and _ from acting as placeholders. addslashes() and htmlspecialchars() are not a reliable protection against SQL injection.