html variables in MySQL LIKE clauses

BryanEW710

Hey all...this is driving me up the wall...

Does anyone know the correct syntax for putting your variables into a WHERE <variable> LIKE "%x%" clause? Here is my code:

$query = "select * from Users where .$fname. like '%".$fname."%' or .$lname. like '%".$lname."%' or .$ssno. like '%".$ssno."%'";

What the form is designed to do is take in a person's first name, last name, and SSN. It then passes these variables on to the script where a connection to the database is made and then this query is passed. Of course, I want to find any records where, for example, a person entered "b" in the first name field, I would want them to see anyone with a first name starting with "b".

What the heck is the right syntax for this? All this query does is select everything in the database. It's as if it sees "SELECT * FROM $tablename";

Any ideas?

bastien

inside the query

$query = "select * from Users where .$fname. like '%\".$fname.\"%' or .$lname. like '%\".$lname.\"%' or .$ssno. like '%\".$ssno.\"%\'";

BryanEW710

Thanks for the quick reply...unfortunately, it didn't work...😕

BryanEW710

Here's the entire search code.

<html>

<head>
<title>Search Results...Powered by BRYAN and search.php!!!!!!!!!</title>
</head>

<body>

<h2>Hope that this is the person you wanted...</h2>

<?php

$hostname = "192.168.1.4";
$username = "bryan";
$password = "bryan";
$dbname = "User";
$tablename = "Person";

trim($fname);
trim($lname);
trim($ssno);

$fname = addslashes($fname);
$lname = addslashes($lname);
$ssno = addslashes($ssno);

$link = mysql_pconnect($hostname,$username,$password);

if(!$link)
{
echo "Don't worry...it's never a user error ID-10-T";
exit;
}

mysql_select_db($dbname);

$query = "select * from $tablenamie where .$fname. like '\".$fname.\"%' or .$lname. like '\".$lname.\"%' or .$ssno. like '\".$ssno.\"%\'";

$result =@ mysql_query($query,$link);

$num_results =@ mysql_num_rows($result);

echo "Out of ".$num_results." people,";
echo " this person should be in here somewhere...";

for($i=0; $i < $num_results;$i++)
{
$row = mysql_fetch_array($result);
echo "<table>";
echo "<tr><td><b>First Name:</td></b><td><b>Last Name:</b></td>";
echo "<td><b>SSN:</td></b></tr>";
echo "<tr><td>";
echo htmlspecialchars( stripslashes($row["fname"]));
echo "</td><td>";
echo htmlspecialchars( stripslashes($row["lname"]));
echo "</td><td>";
echo htmlspecialchars( stripslashes($row["ssno"]));
echo "</td><td></tr>";
echo "</table>";
}

</body>
</html>

mbeem

Several things come to mind...

First off, assuming you copied and pasted...your tablename var in the query is mistyped ($tablenamie as opposed to $tablename)...

Second...are the column names themselves different each time the query is passed? If not, try the actual column name:

$query = "select * from $tablename where fname like '$fname%' or lname like '$lname%' or ssno like '$ssno%';

If I'm having trouble with a query statement, I 'll use an echo statement right after I declare the variable. Sometimes seeing the full statement with the vars interpreted helps. If that doesn't point it out, I'll paste the query to the command line and run it. If the problem is in the query construct, you'll usually get a descriptive error message that helps narrow down the problem.

$query = "blah blah blah";
echo "<p>$query</p>\n";

Hope this helps.

BryanEW710

THANK YOU! j00 r d man!

IT WORKED!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!