Is this a 100% safe from SQL Injection and will work correctly for any input? $a=$_GET["a"];
$b=$_GET["b"];
$a=str_replace("%", "\%", $a);
$b=str_replace("%", "\%", $b);
$sql="SELECT * FROM table ";
$sql.="WHERE ColA LIKE :txtA AND ColB LIKE :txtB";
$query = $db-&gt;prepare($sql);
$query-&gt;bindValue(':txtA', '%'.$a.'%', PDO::PARAM_STR);
$query-&gt;bindValue(':txtB', '%'.$b.'%', PDO::PARAM_STR);
$query-&gt;execute();


I want to give user ability to search anything. Should I filter more characters? Will it be 100% safe and work as it should do for searching pieces of text in database?

Edit:
ColA and ColB are strings, just text (phrase and tags in search engine)
I want to give user ability to search anything.


It looks like you've achieved that, however, I'd use $_POST to reduce the likelihood that your application will be taken offline by users opening multiple tabs or search engine spiders hitting URLs.


  Will it be 100% safe and work as it should do for searching pieces of text in database?


Looks good for SQL injection.

As to whether it "should do" - have you considered generating the query dynamically to allow for tokenized search on inputs like "foo bar"? (i.e. ColB LIKE :token1 OR ColB LIKE :token2)