a problem with database

[medlinux]

hi
I try to use this code in order to avoid injection SQL

Code: Select all

   $reponse = $bdd->prepare("SELECT * FROM Table1 WHERE  Titre LIKE '%?%' OR Auteur LIKE '%?%' OR Editeur LIKE '%?%' ");
   $reponse->execute(array($_POST['book_title'],$_POST['book_author'],$_POST['editor']));


but it wants work
could you help me ?

[NigelRen]

When you say it won't work - what error are you getting? Or is it just returning everything?