Creating A Simple Search

[hasek522]

Here is the code im using to make a search for a sql database of people.  Right now its not very good as I have never done anything like this before.  Any suggestions or help would be GREATLY appreciated.  Here is the code:

 

$search = $_POST['search'];

$search = '%' . $search . '%';

$sql = "SELECT * FROM stylists WHERE firstname like '" . $search . "';";

$db = mysql_connect($dbhost, $dbuser, $dbpassword);

mysql_select_db($dbdatabase, $db);

$query = mysql_query($sql);

 

I think the main problem is I do the query poorly. 

[btherl]

Does your script do what you want it to do?  It looks fine at a glance.

 

Though you should escape your input like this:

 

$search = $_POST['search'];
   $search = '%' . $search . '%';
   $search = mysql_real_escape_string($search);
    $sql = "SELECT * FROM stylists WHERE firstname like '" . $search . "';";

 

Otherwise people will be able to control your database with sql injection.

[hasek522]

well it does "search" but not very well.  Its not like very sensitive and you have to put in like Jason to find Jason.  If I put "Jason cool" it does not find "Jason".  Preferrably I would like to have it sensitive enuf so that like "Jasom" would show "Jason"

[genericnumber1]

well correcting them for jasom to be jason would require google-esqe "I'm better than you, so this is how you REALLY spell the word" powers.... but if you're searching large blocks of text you can look into full text search...

 

http://www.google.com/search?hl=en&safe=off&client=firefox-a&rls=org.mozilla:en-US:official&hs=hCT&sa=X&oi=spell&resnum=0&ct=result&cd=1&q=full+text+search+php&spell=1

 

of course there's always the option of using google search for your website, but that's not good for searching specific sections of data.

[hasek522]

hmmm im not really sure what to do then.  Can I use google search to query a mysql database like i am doing?

[GingerRobot]

As suggested, if you want to improve your results, look into full-text searching. As for things like 'Jasom' finding 'Jason' it would be possible to look into sound matching (both 'words' have the same soundex value). I seriously doubt it's worth it though. Just return the user to a 'no results found' page, and ask them to check the thing they searched for.

 

Edit: Should also add, im not entirely sure of how useful any sound matching would actually be.