MySQL query returning rows from every user

Question

I have a simple search script to search a database which should return all the rows of data that match the search query that belong to that user, however my query (below) is returning rows from every user. Any idea how to fix this?

SELECT * FROM tablename 
WHERE title LIKE '%" . $q . "%' 
OR text LIKE '%" . $q . "%' 
AND user='$user'

Side Note: This is executed in PHP so the $q is the variable that holds the query.

@BryanH yes it contains the username from a session variable (defined earlier) — Stephen Cioffi
– Stephen Cioffi, Commented Nov 18, 2012 at 3:52

salih0vicX · Accepted Answer · 2012-11-18 03:50:22Z

2

Have you tried this?

"SELECT * FROM tablename WHERE (title LIKE '%".$q."%' OR text LIKE '%".$q."%') AND user='$user'"

answered Nov 18, 2012 at 3:50

salih0vicX

1,3831 gold badge8 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Stephen Cioffi Over a year ago

This works great for the null input value however if a space is entered either by itself "[SPACE]" or in a statement "word[SPACE]"... Nothing is returned.

Mike Over a year ago

@4cpukid, can you provide an example where nothing is returned by echoing the query string?

Stephen Cioffi Over a year ago

@Mike "[SPACE]" and anything that has a [SPACE] in it. So if I search "birds[SPACE]" even if there is not a second word it won't even return the rows with "birds".

Mayank K. Swami Over a year ago

@4cpukid also try ' or '1'='1

Mike Over a year ago

@Stephen, that's not the query string. I mean the whole thing including SELECT * FROM etc.

kabuto178 · Accepted Answer · 2012-11-18 03:50:30Z

0

Clear the $user variable of any white space before trying the SQL query

answered Nov 18, 2012 at 3:50

kabuto178

3,1774 gold badges46 silver badges67 bronze badges

1 Comment

Mike Over a year ago

Why would white space affect it?

BryanH · Accepted Answer · 2012-11-18 03:55:58Z

0

Try this:

<?php 
...
echo "SELECT * FROM tablename 
WHERE title LIKE '%" . $q . "%' 
OR text LIKE '%" . $q . "%' 
AND user='$user'";

And see what the output looks like.

Just as an aside, you can probably get away with

WHERE title LIKE '%$q%'

(i.e., not having to concatenate the query string). This will keep your code a bit cleaner and reduce errors (from missing a period/quote).

answered Nov 18, 2012 at 3:55

BryanH

6,1133 gold badges36 silver badges47 bronze badges

Collectives™ on Stack Overflow

MySQL query returning rows from every user

3 Answers 3

5 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related