MySQL Injection by LIKE operator [duplicate]

Question

I've below code in one of my php files to fetch data from DB:

$products = $this->db->get_rows('SELECT * from products WHERE shop_id='.$_SESSION['shop_id'].'AND tags,title,text LIKE \'%'.$_POST['search'].'%\'');

Is it problematic? I mean LIKE operator can be injected?

Edited

please provide examples of injecting in this way

Answer 1

Any operator can be injected without binding.

$_POST['search'] = "1%'; DROP TABLE myTable LIKE '%";

Would make

.... AND tags,title,text LIKE '%1%'; DROP TABLE myTable LIKE '%%'

Read on how to bind parameters.

Answer 2

Of course this can be injected, you need to sanitize your input. Right now you are taking raw post data and inserting it into your SQL statement.

You should run your POST data through some sort of data sanitization, something like mysql_real_escape_string or the like

Or at least prepared statements. let server side code do the work for you.