PHP Form Searching MySQL Database

Question

currently working on a search form and it's going great, however it's not picking up any of the results successfully.

Here's a screenshot of the database

As you can see there are several results with the word "dragon"

Now if you go to search.php?name=dragon it brings up these results:

Results

Sorry, your search: dragon returned zero results

You searched for: dragon

Results
End of results

Here's the search query:

$searchTerm = trim($_GET['search']);
$query = "select * from item where name like '$searchTerm' order by name";
$numresults=mysql_query($query);
$numrows=mysql_num_rows($numresults);
if ($numrows == 0) {
echo "<h4>Results</h4>";
echo "<p>Sorry, your search: " . $searchTerm . " returned zero results</p>";
}

Why is it not displaying any of the results? Any help would be appreciated.

Marc B · Accepted Answer · 2011-12-30 04:36:52Z

1

YOu didn't specify the wildcard operators for the like operation. Without wildcards, somefield LIKE 'something' is exactly the same as somefield='something'.

Your query should be

SELECT ... LIKE '%$searchTerm%';
                 ^--         ^-- wildcards

and note that you're WIDE open to SQL injection attacks. At bare minimum you should have

$searchTerm = mysql_real_escape_string($_GET['search']);

or better yet, switch to using PDO prepared statements.

answered Dec 30, 2011 at 4:36

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Travs Over a year ago

thanks, i did originally have the wildcards in place but i was told to remove them since they would just end up causing an error also, i've added the mysqlrealescapestring as you recomended, thanks i almost forgot about sql attacks :P as for this topic, the wildcards fixed it, thanks

Marc B Over a year ago

They shouldn't cause an error, unless you mis-used them, e.g. something like ... LIKE %keyword% without quotes, or outside quotes like ... LIKE %'keyword'%.

Travs Over a year ago

well the original version was /"%$searchTerm%/" but was having issues with old parts of the code that i've now removed, i thought the "like" part of the query was the cause of the wildcard :P

Collectives™ on Stack Overflow

PHP Form Searching MySQL Database

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related