title: MySQL Injection by LIKE operator
body: <p>I've below code in one of my php files to fetch data from DB:</p>
  
  <pre><code>$products = $this-&gt;db-&gt;get_rows('SELECT * from products WHERE shop_id='.$_SESSION['shop_id'].'AND tags,title,text LIKE \'%'.$_POST['search'].'%\'');
  </code></pre>
  
  <p>Is it problematic? I mean LIKE operator can be injected?</p>
  
  <p><em><strong>Edited</em></strong></p>
  
  <p>please provide examples of injecting in this way</p>