Um..what's wrong with this declaration?

[deezzer]

Hi.

I'm getting errors on the following line where the $condition variable starts:

if ($POST['condition']== 'all') {
$condition = "firstname LIKE '{$POST['adminsearchterm']}%' or lastname LIKE '$POST['adminsearchterm']%' or log LIKE '$POST['adminsearchterm']%' or email";
}

Is there something i shouldn't be doing?

Thanks

[Drakla]

Take out the single quotes within the square brackets. And something you should be doing is escaping the data for the query, but look for that in the database section

[thorpe]

Quotes should remain for non numerical indexes, you just need to surround your arrays in {}.

if ($_POST['condition']== 'all') {
  $condition = "firstname LIKE '{$_POST['adminsearchterm']}%' or lastname LIKE '{$_POST['adminsearchterm']}%' or log LIKE '{$_POST['adminsearchterm']}%' or email";
}

Drakla is right about escaping the data though. Take a look at [man]mysql_real_escape_string/man.

[deezzer]

Ok, i took out the single quotes, and it worked, even though it wasn't numeric. (wierd)

One last question: when should we be using single quotes inside brackets if this was the case?

weird. perhaps it was because i had all those other symbols like % and [] ?

[deezzer]

Thank you Drakla and thorpe for reminding me about the mysql_escape_string...