I'm just new here.
I would like to ask if my following SQL is correct and where did I do wrong?
This is my SQL in my php file
$sql = "SELECT * FROM tblAlumni WHERE fname LIKE '%$search_file%' or mname LIKE '%$search_file%' or lname LIKE '%$search_file%' AND alum_status LIKE 2"
It got no errors whatsoever but it doesn't display the correct data.
This is my table
and the result if i've search it or query it is this
Click here Thank you for future answers.
Your query will be executed like this
SELECT *
FROM tblAlumni
WHERE fname LIKE '%$search_file%'
OR mname LIKE '%$search_file%'
OR ( lname LIKE '%$search_file%'
AND alum_status LIKE 2 )
because AND has higher precedence than OR. Parenthesis are very important for execution of Where clause
SELECT *
FROM tblAlumni
WHERE ( fname LIKE '%$search_file%'
OR mname LIKE '%$search_file%'
OR lname LIKE '%$search_file%' )
AND alum_status = 2
Use = instead of LIKE when you are looking for exact match it makes more sense to me
Update :
SELECT *
FROM tblAlumni
WHERE ( fname LIKE '%$search_file%'
OR mname LIKE '%$search_file%'
OR lname LIKE '%$search_file%' )
AND alum_status LIKE 2
AND yeargrad LIKE '$year'
AND instead of comma
$search_fileis not being handled before putting it in the you've opened yourself to SQL injections (depending on how you are handling it could still be open). You are best off to use parameterized queries.mysqlidoes nothing to prevent SQL injections by default. Best to learn the right way first :), php.net/manual/en/mysqli.quickstart.prepared-statements.php