First of all, it is best if you separate the parameters of the query (the values and variables queried) and the query itself. To do this, you'll need to use mysqli or PDO. This is good practice anyway, because the old 'mysql' functions are deprecated and will be removed. Here is the documentation for mysqli, which will be the easiest upgrade path for you.
First, put the parameters of your query into variables.
$input = '222 ';
Then use trim().
$input = trim($input);
And last, run your query.
$stmt = mysqli_stmt_init($database);
mysqli_stmt_prepare($stmt, 'select * from codes where code = ?');
mysqli_stmt_bind_param($stmt, 's', $input);
mysqli_stmt_execute($stmt);
//Note: Make sure to know how many columns you're getting.
$output = array();
mysqli_stmt_bind_result($stmt, $id, $name, $code);
while (mysqli_stmt_fetch($stmt)) {
$output[] = array($id, $name, $code);
}
This looks like a LOT more code than you have, but each line serves an important purpose, and sometimes you might want to do other things between them. I would highly recommend looking through the mysqli documentation, and while yes they allow you to do a simple 'mysqli_query()' call that's nearly identical to the 'mysql_query()' you're using, it's a bad idea is it leaves you open for things like SQL injection attacks.
Here is a good overview about why you should use prepared statements, and a quick look at how to use them in various languages (including PHP).