LIKE Clause not working due to php variable

Question

this is my code....have tried to echo the $sql but it shows '%Search%'...but i want to use it as $Search .. plz help ...

Below is my entire code for search...

if(isset($_POST['search']))

 {

$search=$_POST['search'];

$criteria=$_POST['criteria'];

$table='alumni';

mysql_real_escape_string($search);

if($criteria=='ALL')

{

$sql="SELECT UNAME FROM `alumni` ";

$result=mysql_query($sql); 

if (!$result) {

die('Invalid query: ' . mysql_error());

}

while ($row=mysql_fetch_array($result))

{

echo"<tr><td><a>".$row['UNAME']."</a></td></tr>"; 

}

}

                                    if($criteria=='UNAME' || $criteria=='FNAME' || $criteria=='BATCH')

{

//echo $criteria;

$sql="SELECT UNAME FROM `alumni` WHERE ".$criteria." LIKE '%".$search."%'";

//echo $sql;

$result=mysql_query($sql); 

if (!$result) {

die('Invalid query: ' . mysql_error());

}

while ($row=mysql_fetch_array($result))

{

echo"<tr><td><a>".$row['UNAME']."</a></td></tr>"; 

}

}


}

?>

Do not use `mysql_*` functions, they're deprecated, use `mysqli_*` instead. — akluth, Apr 16 '13 at 07:35
please use mysqli_ or PDO instead of mysql_ extension as it's deprecated, and less safe — aleation, Apr 16 '13 at 07:35
you get string 'Search' if you print $search var? how does your sql looks like if for example you put criteria 'FNAME' and search 'text'? — Bojan Kovacevic, Apr 16 '13 at 07:40
@BojanKovacevic...it displays the usernames regarding the search criteria...the above code works fine for $criteria==ALL..it is not able to display any result for the below if condition...!! please help..!! — , Apr 16 '13 at 07:49

score 2 · Answer 1 · answered Apr 16 '13 at 07:51

From testing the above code there seems to be nothing wrong, if you pass search=Test you get:

SELECT UNAME FROM `alumni` WHERE FNAME LIKE '%Test%'

If you are always getting...

SELECT UNAME FROM `alumni` WHERE FNAME LIKE '%Search%'

...no matter the value you fill in your search form it would suggest there is a problem with how that form works, or how the post data is put together. The code you've posted above, whilst rather out-dated, works as you would expect from code that searches a database.

If you could post more information with regard to how this script is called or used you'll probably get a more accurate answer from someone.

score 0 · Answer 2 · edited Apr 16 '13 at 07:50

0

If you use double quotes you can put you variables in strings without closing them.

Try:

$sql="SELECT UNAME FROM `alumni` WHERE $criteria LIKE '%$search%'";

edited Apr 16 '13 at 07:50

Anirudh Ramanathan

46,179
22
132
191

answered Apr 16 '13 at 07:49

lolinthedark

65
2
12

LIKE Clause not working due to php variable

2 Answers2