Post

We passed the search box straight into a LIKE query. Someone typed a single percent sign, and the filter matched every row in the table. A percent sign in a LIKE is a wildcard, not a letter. Escape the wildcards before they reach the query.