PHP MySQL LIKE command not working properly

Question

I am trying to retrieve data from a table based on if the user enters characters in a search bar which match with a variable that holds the description of an item.

I am doing this using MySQL in PHP and this is the retrieval code I have so far:

$ItemDesc = $_POST['ItemDesc'];

$query = "select * from StockItems where ItemDesc LIKE '%$ItemDesc%'";

However I am not getting back the right result, what I am getting back is all the data in the SQL table despite entering unmatching characters all the time.

So e.g. if in the SQL tabel I have one field and the ItemDesc row contains 'Fight', if i enter 'xxx' into the search box and click enter the field will always be retrieved.

Are you sure $_POST['ItemDesc'] contains a value other than null or an empty string? LIKE '%%' would return all results. Try var_dump($_POST['ItemDesc']) and verify. — phpisuber01
– phpisuber01, Commented May 22, 2013 at 17:29

Orangepill · Accepted Answer · 2013-05-22 17:29:11Z

3

You aren't getting your $ItemDesc variable set so to mysql it's looking like

select * from StockItems where ItemDesc LIKE '%%'

Try to print_r or var_dump the contents of $ItemDesc and the $_POST to see where things are falling down. But it would be a good idea to make sure $ItemDesc meets at least some criteria (min length) before issuing the query

Also sanitize the inputs coming from userland

answered May 22, 2013 at 17:29

Orangepill

24.7k3 gold badges44 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Ryman Holmes Over a year ago

Doesn't $ItemDesc = $_POST['ItemDesc']; set it?

Orangepill Over a year ago

it will set it assuming the name on the input that posted it is ItemDesc and the form action is post and the user put information in the field. Lot of ands there... best to just make sure

Ryman Holmes Over a year ago

Great, Thanks @Orangepill the problem was my input name was different from the variable. After all it was the html that was wrong :/

Yuliam Chandra · Accepted Answer · 2014-09-27 04:48:21Z

-2

$item = $_POST['itemDesc'];

$result = mysql_query("select * from StockItems where ItemDesc LIKE '%$item%'");

This query is select the result for user assigning character for all places in the itemdesc field.

edited Sep 27, 2014 at 4:48

Yuliam Chandra

14.7k12 gold badges56 silver badges70 bronze badges

answered Sep 27, 2014 at 4:28

Saravana Kumar

215 bronze badges

Collectives™ on Stack Overflow

PHP MySQL LIKE command not working properly

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related