Can Anyone exectue my query..

[SumitGupta]

Hi..

I am having problem in executing the Query below

$con= mysql_connect("localhost", "","");
$db=mysql_select_db("WebTest");
$p="\"'";
echo $p."<br>";
// name like \"%'%\" or name like '%\"%' or
$query="select * from try where  name like \"$p\" or name like '$p'";
echo $query;
$r=mysql_query($query);
if (mysql_num_rows($r) >0)
{
while ($ar=mysql_fetch_array($r))
{

echo "<br> In data   ".$ar[1] ."<br>";
}
}
else
{
	echo "Empty";
}

The above query simple trying to display the result that can contain either " or ' or both of them. It works if the condition of 'like' is given in the $query varaible but not if done from other variable like session variable of POST or Get etc.

Any help

[tsinka]

Hi,

use mysql_escape_string like e.g.

$p = mysql_escape_string($_POST['avar']);
$query = "select * from try where  name like '%$p%'";

Using %something% in a query should be avoided if possible because that would make MySQL not to use any indexes on.

Thomas

[SumitGupta]

Thanks for your help it solve my problem.

Alternatively I have used the addslashes() for the same and both work similarly,

Though many thanx to u