Use variable on the mysql like sentence on laravel query builder - mysql

Question

$key was a variable can be empty or something.
var key='"<?php echo $_REQUEST['key']; ?>"';
then send to the ajax by data
"ajax": {
"url": "{{asset("try")}}",
"type": 'POST',
"dataType": 'json',
"async": true,
"data": {
key : key,
},
}
the try Controller
public function try(Request $request){
$key=$request->key;
DB::query()
->select('A.id','A.upper_p_id','A.key')
->from('users as A')
->leftjoin('products as B', function($join) {
$join->on('A.ID', '=', 'B.p_id');
})
->groupBy('A.id','A.upper_p_id','A.key')
->where('A.key', 'LIKE', '%'.$key.'%');
->get()
return $result;
}
I got the error expression from the queries debug tool?
LIKE '%\"\"%'
But if I use
->where('A.n_geography','LIKE', '%'.''.'%');
It is right sentence from the queries debug tool.
LIKE '%%'

Answer 1

Well - you did put in the double quotes in the key variable...
So it's doing it correctly :-)

Answer 2

If you are trying to get key from request, you ideally should no use $_GET o $_POST.
public function getData(Request $request){
$key = $request->key;
$records = DB::table('users')
->leftJoin('products', 'users.id', '=', 'products.p_id')
->groupBy('users.id','users.upper_p_id','users.key')
->where('users.key', 'LIKE', '%'.$key.'%')
->select('users.id','users.upper_p_id','users.key')
->get();
return response()->json($records, 200);
}
However if the key variable is a javascript variable, then you can not directly use in controller. You need to pass it somehow in route param or using ajax request.
Secondly if you can add conditional when that if $key is present then only do a where clause :
public function getData(Request $request){
$key = $request->key;
$records = DB::table('users')
->leftJoin('products', 'users.id', '=', 'products.p_id')
->groupBy('users.id','users.upper_p_id','users.key')
->when($key, function($q) use($key){
return $q->where('users.key', 'LIKE', '%'.$key.'%');
})
->select('users.id','users.upper_p_id','users.key')
->get();
return response()->json($records, 200);
}

Answer 3

You're double quoting key. The suggested way to share PHP variables as JS variables is to JSON encode them for example:
var key= {!! json_encode(request()->input('key')) !!};
Note that there are no additional quotes necessary in the JS code because valid JSON is also a valid JS variable.
Also note that since you are using Laravel it is recommended you use blade markup and the request() helper for accessing the request parameters

Answer 4

In order to prevent SQL injection it is better not to concatenate the value directly but pass it as a param so try this:
$key = $request->key;
...
->whereRaw('A.key like ?', ['%' . $key . '%']);
And in your JS:
var key='<?php echo $_REQUEST['key']; ?>';