mysql中like语句注入,通过LIKE运算符进行MySQL注入

I've below code in one of my php files to fetch data from DB:

$products = $this->db->get_rows('SELECT * from products WHERE shop_id='.$_SESSION['shop_id'].'AND tags,title,text LIKE \'%'.$_POST['search'].'%\'');

Is it problematic? I mean LIKE operator can be injected?

Edited

please provide examples of injecting in this way

解决方案

Any operator can be injected without binding.

$_POST['search'] = "1%'; DROP TABLE myTable LIKE '%";

Would make

.... AND tags,title,text LIKE '%1%'; DROP TABLE myTable LIKE '%%'