USE LIKE with php variable

Question

I have a problem using LIKE with PHP variables. I would like to select, based on a username, what matches the username in the DB. Here is my code:

$dbhost = "localhost";
$dbuser = "root";
$dbpass = "1234";
$dbname = "coffeecorner";
$connection = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);

$user = $_SESSION['username'];  

$sql  = "select username ";
$sql .= "from add_reservation";
$sql .= "where username like" . $user;
$result = mysqli_query($connection, $sql);

if(!$result)
{
   die("database query fail!" . mysqli_error($connection));
}

Error

database query fail! You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'likeipin' at line 1

Any help would be appreciated!

The argument to LIKE has to be a string, so it needs quotes around it. But you should learn to use prepared statements with mysqli_stmt_bind_param instead of substituting variables into the SQL. — Barmar
– Barmar, Commented Mar 2, 2017 at 1:07
Why do you need to use LIKE? If you're looking for a specific username, it should be =, not LIKE. You use LIKE when you're trying to match a pattern with wildcards in it. — Barmar
– Barmar, Commented Mar 2, 2017 at 1:08
Your actual LIKE clause should be similar to this: where username like '%Mond%' ... currently, you are missing a space. And please use prepared statements here. — Tim Biegeleisen
– Tim Biegeleisen, Commented Mar 2, 2017 at 1:08
Your script is at risk of SQL Injection Attack Have a look at what happened to Little Bobby Tables Even if you are escaping inputs, its not safe! Use prepared parameterized statements — RiggsFolly
– RiggsFolly, Commented Mar 2, 2017 at 1:10

Barmar · Accepted Answer · 2017-03-02 02:34:33Z

1

You need quotes around the username. Also, if you're using LIKE to match a pattern, you should have wildcards in it.

$sql .= "where username likem '%$user%'";

But it's better to use a parametrized query.

$sql = 'SELECT username
        FROM add_reservation
        WHERE username like ?';
$user_pattern = "%$user%";
$stmt = mysqli_prepare($connection, $sql);
mysqli_stmt_bind_param($stmt, "s", $user_pattern);
$result = mysqli_stmt_execute($stmt);
if (!$result) {
    die("database query fail!" . mysqli_error($connection));
}

answered Mar 2, 2017 at 2:34

Barmar

789k57 gold badges554 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

kourouma_coder · Accepted Answer · 2017-03-02 01:44:50Z

0

You neeed to add a little a space after like :

$dbhost = "localhost";
$dbuser = "root";
$dbpass = "1234";
$dbname = "coffeecorner";
$connection = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);

$user = $_SESSION['username'];  

$sql  = "select username ";
$sql .= "from add_reservation";
$sql .= "where username like " . $user;
$result = mysqli_query($connection, $sql);

if(!$result)
{
  die("database query fail!" . mysqli_error($connection));
}

check the error message : database query fail!You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'likeipin' at line 1

the word like is stuck with the username forming a single string likeipin ; it should be like ipin meaning $sql .= "where username like " . $user;

Be carefull on session, session_start should be used before accessing session variable.

You can use this query string : $sql = "SELECT username FROM add_reservation WHERE username LIKE '%". mysql_real_escape_string($user) ."%'" or this one :
$sql = "SELECT username FROM add_reservation WHERE username LIKE '%".$user."%'"
Hope it help.

edited Mar 2, 2017 at 1:44

answered Mar 2, 2017 at 1:17

kourouma_coder

1,1082 gold badges13 silver badges24 bronze badges

2 Comments

Mohd Ariffin Over a year ago

I have add a space ' $sql .= "where username like " . $user; ' , is throw an error ==> 'database query fail!You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'like ipin' at line 1'

Mohd Ariffin Over a year ago

session_start() has been declared in the beginning of the code

Mohd Ariffin · Accepted Answer · 2017-03-02 02:50:25Z

0

after a few hours thinking and trying i have found the solution. this a the new code. We need to input a braces () on it;

if(session_id()=='' || isset($_SESSION['username'])){

$dbhost = "localhost";
$dbuser = "root";
$dbpass = "1234";
$dbname = "coffeecorner";
$connection = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname);

$user = $_SESSION['username'];  

$sql  = "(SELECT * FROM add_reservation WHERE username like '$user')";
$result = mysqli_query($connection, $sql);

if(!$result)
{
   die("database query fail!" . mysqli_error($connection) . mysqli_errno($connection));
}

Hope it helped !

answered Mar 2, 2017 at 2:50

Mohd Ariffin

135 bronze badges

2 Comments

Barmar Over a year ago

The parentheses are totally unnecessary.

Barmar Over a year ago

I didn't say they're wrong, they're just unnecessary. You only need parentheses around a query when you're using it as a subquery. If it's the main query, they're redundant, and it should work just as well without them.

Collectives™ on Stack Overflow

USE LIKE with php variable

3 Answers 3

Comments

2 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related