0

I'm having some problems with my search module on my website. I'm using this code:

    if(!isset($_POST['search'])) {
$query = "SELECT id, title FROM cars ORDER BY id LIMIT ? OFFSET ?";
}
if(isset($_POST['search']) && $_POST['categories'] != "all") {
$query = "SELECT id, title FROM cars WHERE title LIKE CONCAT(?, '%') ESCAPE '+'  AND category = ? ORDER BY id LIMIT ? OFFSET ?";
}
if(isset($_POST['search']) && $_POST['categories'] == "all") {
$query = "SELECT id, title FROM cars WHERE title LIKE CONCAT(?, '%') ESCAPE '+' ORDER BY id LIMIT ? OFFSET ?";
}
try { 
    $stmt = $db->prepare($query); 
    if(!isset($_POST['search'])) {
        $stmt->bindValue(1, (int) $limit, PDO::PARAM_INT);
        $stmt->bindValue(2, (int) $offset, PDO::PARAM_INT);
    }
    if(isset($_POST['search']) && $_POST['categories'] != "all") {
        $search= str_replace(array('+', '%', '_'), array('++', '+%', '+_'), $_POST['search']);
        $stmt->bindValue(1, $search, PDO::PARAM_STR);
        $stmt->bindValue(2, (int) $_POST['categories'], PDO::PARAM_INT);
        $stmt->bindValue(3, (int) $limit, PDO::PARAM_INT);
        $stmt->bindValue(4, (int) $offset, PDO::PARAM_INT);
    }
    if(isset($_POST['search']) && $_POST['categories'] == "all") {
        $search= str_replace(array('+', '%', '_'), array('++', '+%', '+_'), $_POST['search']);
        $stmt->bindValue(1, $search, PDO::PARAM_STR);
        $stmt->bindValue(2, (int) $limit, PDO::PARAM_INT);
        $stmt->bindValue(3, (int) $offset, PDO::PARAM_INT);
    }
    $stmt->execute(); 
} 
catch(PDOException $ex) { 
    die("Failed to run query: " . $ex->getMessage()); 
} 
$cars = $stmt->fetchAll(); 

My search form looks like this:

<input name="search" type="text" size="20" maxlength="20" />
<select name="categories">
    <option value="all">All Categories</option>
    <option value="1">Free</option>
    <option value="2">In use</option>
    <option value="3">Damaged</option>
</select>

In cars table, each title look like this: 2009 Porsche 911 (year make model) When I search, if I don't fill in search box, it works ok, it works ok even when I search for 2009, but if search for Porsche, I get no results. Why is that? What is wrong with my code?

2
  • Note, shorthand for limit ? offset ? would be limit ?,?. I prefer it but personal preference :)
    – webnoob
    Mar 9, 2013 at 18:02
  • I would look in the str_replace code. maybe you can var_dump the result of it and get a clue.
    – Ateszki
    Mar 9, 2013 at 18:10

1 Answer 1

1

CONCAT(?, '%') means that you search for words who start by the search-word .

so 2009 is the first word thats why it return . if you want get the second word try using this

    CONCAT('%',?, '%')

or just like that

    CONCAT("'",?, "'")
3
  • values from <select name="categories"> are integers, If I search for Porsche and leave <option value="all">All Categories</option> selected, $stmt->bindValue(2, (int) $_POST['categories'], PDO::PARAM_INT); doesn't apply
    – user2145556
    Mar 9, 2013 at 18:10
  • using CONCAT('%',?, '%') works, thank you. Another question is how safe is my code as it is now?
    – user2145556
    Mar 9, 2013 at 18:19
  • until it is finished , I prefer to use catch
    – user2145556
    Mar 9, 2013 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.