php - Is a mysql LIKE statement with an escaped string containing unescaped wildcards '%' (percent) or '_' (underscore) vulnerable? -

let's have following code (for kind of search or similar):

$stmt = $pdo->prepare("select * users username ?"); $stmt->execute(array('%' . $username . '%')); 

the username supplied escaped, characters %(= 0 or more arbitrary characters) , _ (= 1 arbitrary characters) interpreted wildcard mysql.

i understand users enter % or _ search , should escape if want search function work properly. (in cases set_pt , getting setopt in result).

but question is: exploit this? if yes, how exploit , how prevent it? function below suffice?

function escape_like_string($str) {   return str_replace(array('%', '_'), array('\%', '\_'), $str); } 

one possibility think of entering tons of %, server need allocate lot of memory. work?

could exploit this?

for sql-injection? no.

for easter-egg behavior? probably. in case, if don't want let users use wildcards in search, can 2 things:

1. proper escape wildcards (and escape character),

   str_replace(array('\\', '%', '_'), array('\\\\', '\\%', '\\_'), $str); // or: str_replace(array('|', '%', '_'), array('||', '|%', '|_'), $str); // select * users username ? escape '|' 

2. or use locate(substr, str) > 0 find exact matches.