Wildcards and $_GET?

[ComCool]

Is there no way to use the wildcard % on the $_GET?

$result = mysql_query("SELECT * FROM items WHERE name LIKE '". $_GET['item']."'");

Or is the only way

$temp = $_POST['item']; 
$result = mysql_query("SELECT * FROM items WHERE name LIKE '$temp%'");

Can't get it to work on my $_GET, maybu i'm just placing the % wrong 😐

[dalecosp]

I'd think it could be done, but why would you want to ... you should never trust client data that implicitly....

[ozzythaman]

$_GET['item']=mysql_escape_string($_GET['item']);
$result = mysql_query("SELECT * FROM items WHERE name LIKE '". $_GET['item']."%'");

at LEAST do a escape string thing..
the % goes as shown

edit: and put a isset($_GET['item']) in the beginning or else youll get lots of errors if its not set..

and keep in mind that if $_GET['item']=="" then all items will be shown