LIKE , % , < problem

[fxuser]

So i have this simple query running each time i write something in an input text via Ajax:

$query = mysql_query("SELECT names FROM users WHERE names LIKE '$names%'");
while($row = mysql_fetch_assoc($query)){
	echo $row['names'];
}

 

the problem is that i can easily type %,<,^ and whatever else multiple times and then get all the results... which is not what i want... how can i make it so when the user types such symbols not to get anything ?

 

Thanks.

[Jessica]

sanitize your user input. You could use str_replace or a regular expression.

[fxuser]

im using atm :

$bad_symbols = array("%", "^", "<");
$newvar = str_replace($bad_symbols, " ", $phrase);

 

but the last "<" doesnt seem to get replaced..

 

how can i find if there are others symbols too that can give me all the results so i can replace them?

 

thanks

[fenway]

That's a PHP issue, now, isn't it?