[SOLVED] search engine script question

[justAnoob]

Below is the starting of a little search engine that will search 2 fields of a mysql table. Right now it will search 1 field just fine, but on the line below is where I am having trouble getting it to search 2 fields. Any suggestions?

<?php
include "connection.php";
$search=$_POST["search"];
$query = "SELECT imgpath, x1, x2, x3, user_id FROM member_trades WHERE";
$result = mysql_query("SELECT * FROM $tbl_name1 WHERE x1 LIKE '%$search%'");  // I tried the lines below for getting it to search 2 fields.
$uid = $_GET['user_id'];
echo "<table border='1' bgcolor='#FFFFFF'><tr><td bgcolor='#B8D2EO'><H3>x1</h3></td><td bgcolor='#B8D2EO'><H3>x2</H3></td><td      bgcolor='#B8D2EO'><H3>x3</H3></td><td bgcolor='#B8D2EO'><H3>x4</H3></td><td bgcolor='#B8D2EO'><H3>user_id</H3></td></tr>";
while($row = mysql_fetch_array($result))
{
echo "<tr><td align='center'>";
echo '<img src="' . $row['x1'] . '" width="125" alt="" />';
echo "</td><td align='center'>";
echo $row['x2'];
echo "</td><td align='center'>";
echo $row['x3'];
echo "</td><td align='center'>";
echo $row['x4'];
echo "</td><td align='center'>";
echo '<a href="composemessage.php?uid='.$row['user_id'].'"><img src="images/K_little.png" style="border: 0px;" /></a>';
echo "</td></tr>";
}
echo "</table>";

//$result = mysql_query("SELECT * FROM $tbl_name1 WHERE x1, x2 LIKE '%$search%'");
//$result = mysql_query("SELECT * FROM $tbl_name1 WHERE x1 AND x2 LIKE '%$search%'");

?>

 

Also, everyone always talks about security issues with search scripts. What risks are there from someone typing in a keyword from a couple fields in a mysql table and then having the results displayed????

Also,, the script above only displays 1 result,,, even if there are multiple keyword matches.

[neogemima]

If there are multiple keyword matches, you can add up the number of rows it calls from your database and use a for loop.  It would be helpful if your table or database had an id number for each row  Something like:

 

for(i=0; i <= &numrows; i++) {

  ...code to call results from a row and move onto the next...

}

 

This doesn't answer your complete question, but I used something similar to call results from a table where my output was a list of News Titles with keyword pulled out.