[SOLVED] Inserting a variable in a mysql query

[ksduded]

I am trying to insert a variable string inside my query to get the desired results. However, I can't seem to get the desired results. From what I read, there is no way to incorporate a string inside a query. If yes, then is there a work around to it?

 

 

if ( !isset ( $_GET['keywords'] ) ) $_GET['keywords']='';
$string = $_GET['keywords'];

$sql = "SELECT * FROM 
equatorhd_schd WHERE prog_programname LIKE '%'.$string.'%' OR prog_episodename LIKE '%'.$string.'%' OR prog_episodedesc LIKE '%'.$string.'%' ORDER BY prog_date DESC";
$query = mysql_query($sql);

$info = mysql_fetch_assoc($query);
$total = mysql_num_rows($query);

[IsmAvatar]

You're getting single and double quotes mixed up. The query is already in double quotes, and you try to end it with single quotes to inject the string. Since you're already in double quotes, there's no need to end the string, since you can just put the variable directly inside. This is the way it should work:

 

$sql = "<sql stuff> LIKE '%$string%' OR prog_episodename LIKE '%$string%' OR ... etc ... DESC";

[rhodesa]

try this:

$sql = "SELECT * FROM equatorhd_schd WHERE prog_programname LIKE '%{$string}%' OR prog_episodename LIKE '%{$string}%' OR prog_episodedesc LIKE '%{$string}%' ORDER BY prog_date DESC";

[IsmAvatar]

Just curious, rhodesa, but why did you put curly brackets around the variables?

[ksduded]

try this:

$sql = "SELECT * FROM equatorhd_schd WHERE prog_programname LIKE '%{$string}%' OR prog_episodename LIKE '%{$string}%' OR prog_episodedesc LIKE '%{$string}%' ORDER BY prog_date DESC";

 

great this worked.

 

Just one more question. I am getting results with words that are inbetween as well. Like if i search for 'sand', I will get the result 'sandless' as well. So do i only keep it to show results with 'sand' only. I think I need to incorporate that the $string should have a space on both sides of it.

 

Thanks in advance for any help

[IsmAvatar]

simply put a space between the % and the inserted string.

 

LIKE '% {$string} %'

 

I don't think that would find it, though, if "sand" were at the beginning or end of the entry, or if the entry was just "sand". Unfortunately, MySql doesn't have regular expressions. But PHP does, so if need be, you can just use sql for the brunt query, and then filter it down with php.

[ksduded]

simply put a space between the % and the inserted string.

 

LIKE '% {$string} %'

 

I don't think that would find it, though, if "sand" were at the beginning or end of the entry, or if the entry was just "sand". Unfortunately, MySql doesn't have regular expressions. But PHP does, so if need be, you can just use sql for the brunt query, and then filter it down with php.

 

so is there a way to include those results as well by using this method and adding to it?

[rhodesa]

Just curious, rhodesa, but why did you put curly brackets around the variables?

 

It just tells php where the variable starts/ends. In your case, you don't need them. But it saves you in this kind of a case:

<?php
  $pet = 'dog';
  print "I have 3 $pets"; //Doesn't work
  print "I have 3 {$pet}s"; //Works
?>

[jaymc]

Just curious, rhodesa, but why did you put curly brackets around the variables?

 

It just tells php where the variable starts/ends. In your case, you don't need them. But it saves you in this kind of a case:

<?php
  $pet = 'dog';
  print "I have 3 $pets"; //Doesn't work
  print "I have 3 {$pet}s"; //Works
?>

 

I never knew that! very useful

[IsmAvatar]

Thanks rhodesa.

 

ksduded, sure but your query will start to get lengthy and probably takes longer to execute than if you just filtered it with php.

 

...WHERE prog_programname LIKE '%$string%' OR prog_programname LIKE '$string%' OR prog_programname LIKE '%$string' OR field = 'String'

OR prog_episodename LIKE '%$string%' OR prog_episodename LIKE '$string%'...

 

You get the picture. It's not pretty. Compared to a php regular expression, that would be 1 short string that would probably look like this:

'^[.* ]' . $string . '[ .*]$';