Personal Catalogue: PHP & MySQL — Chapter 6, Exercise 3
====================================================

TASK
Add the escape_like() function from this chapter, add a book to your
database with a title containing a literal underscore (e.g.
"Learn_Python: A Guide"), and confirm that searching for the exact
substring "Learn_Python" matches only that book — not accidentally
matching every title where any single character happens to sit where
the underscore is.

SOLUTION

Add the book:

    INSERT INTO items (item_type_id, title, creator)
    VALUES (1, 'Learn_Python: A Guide', 'Some Author');

Also add a second, deliberately similar book to prove the point:

    INSERT INTO items (item_type_id, title, creator)
    VALUES (1, 'LearnXPython: A Guide', 'Another Author');

With escape_like() wired into search.php exactly as shown in the
chapter, search for "Learn_Python":

    search.php?q=Learn_Python&type=0&tag=0

Without escape_like(), the underlying query would be:

    ... WHERE title LIKE '%Learn_Python%' ...

and since _ is a genuine SQL wildcard meaning "any single character,"
this would ALSO match "LearnXPython" (since X is a valid stand-in for
the wildcarded _ position) — an incorrect, over-broad match.

With escape_like() applied, the search term becomes:

    Learn\_Python

and the bound parameter becomes:

    %Learn\_Python%

Now the underscore is treated as a literal character, not a wildcard,
so only the exact substring "Learn_Python" (with a real underscore)
matches.

Confirm directly at the mysql> prompt, comparing both versions:

    -- Without escaping (both rows match — the bug):
    SELECT title FROM items WHERE title LIKE '%Learn_Python%';

    -- With escaping (only the real match):
    SELECT title FROM items WHERE title LIKE '%Learn\_Python%';

Expected output for the escaped version:

    +--------------------------+
    | title                    |
    +--------------------------+
    | Learn_Python: A Guide    |
    +--------------------------+

"LearnXPython: A Guide" correctly does NOT appear once the underscore
is escaped.

WHY THIS WORKS AS AN ANSWER
----------------------------
It builds a deliberately adversarial second title specifically
designed to expose the wildcard bug if escaping weren't applied, then
demonstrates the concrete difference in results between the escaped
and unescaped versions of the same query, rather than only asserting
escaping "is safer" without showing what it actually prevents.