0

Assuming I want to implemante a search engine, is it dangerous to let the user into a LIKE. For example :

SELECT user FROM table WHERE user LIKE "[user input]"

In this case, I assume user will be allowed to type characters such as %,_ We also assume that we properly escape injection characters such as ",',`

I'm thinking about possible Mysql DDOS if the database contain a large amount of user. Is there other(s) risk ?

4

The risk is no different than accepting user input for a regular evaluation. You still need to sanitize the data as well as use safe practices such as stored procedures.

The unique issue with LIKE comes into play when it is used but shouldn't be. For example your application wants to retrieve something with a certain ID but using LIKE could return a similar but different ID. One you wouldn't returned to your end user. But this isn't an issue you should have with a search engine.

On an additional note using LIKE with MySQL will give you a very basic and limited search engine that doesn't scale well at all. For alternatives consider matching against FullText searchable columns or using something meant for the job like Lucene, Sphinx, Elasticsearch, Solr.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.