[SOLVED] Database returning all variables if when it cant fine WHERE

[krio]

I have a mysql database.

 

It locates the data in the table correctly if the table matches, but if I search without inputting data it returns the entire table for some reason.. why is it returning the entire table?

 

function searchDatabase($search) {


	$serialsearcher = substr ( $search, - 4 );

	$querysearch = ("SELECT * FROM parts WHERE serialnumber LIKE '%$serialsearcher' OR name LIKE '%$search%'");
	$resultsearch = @mysql_query ( $querysearch );


	while ( $search = $this->fetch_array ( $resultsearch )) {


		echo "<tr>";

		echo "<td><a href='#' title='Lorem Ipsum'>" . $search ['serialnumber'] . "</a></td>";
		echo "<td><a href='#' title='Lorem Ipsum'>" . $search ['name'] . "</a></td>";
		echo "<td><a href='#' title='Lorem Ipsum'>" . $search ['part'] . "</a></td>";
		echo "<td class='last'><a href='content_partdatabase.php?delete=" . $search ['serialnumber'] . "'>Delete</a></td>";

		echo "</tr>";




	} 




	}

[TeNDoLLA]

You posted a function, that does nothing at all alone unless you call that function which is not present in the code you posted. So where are you calling this function? And that function does not even return anything.

[krio]

I'm just sending in a variable $search that contains string.

 

The problem is that if $search is empty, the entire table is being shown

[PrinceOfDragons]

Add in somewhere that if its blank dont submit the search.

[krio]

yea I did that, but I'm just trying to get to the bottom of why it's happening when I don't think it should be

 

thanks!

[MadTechie]

Well the function does echo's data!

 

the reason your getting all the records is because if $serialsearcher is empty then you are querying the following:~

serialnumber LIKE '%'

which means any!

 

add $serialsearcher to the function parameters and try something like this (rough draft)

$q  ="";
if(!empty($serialsearcher)) $q .= "serialnumber LIKE '%$serialsearcher'";
if(!empty($search))
{
    if(!empty($q)) $q .= " OR ";
    $q .= "name LIKE '%$search%'";
}
$querysearch = ("SELECT * FROM parts WHERE $q ");

[krio]

perfect! thanks! I didn't realize that queries worked that way.. I just thought it would fail

[MadTechie]

if you searched WHERE usernames LIKE '%madtechie%' OR subjects LIKE '%'

it finds every subject as  subjects LIKE '%' means any subject so the username part is kinda pointless

 

I'll also like to point out you shouldn't have the @ on the query as it omit errors (which during development you want to see)

 

if you update to

$resultsearch = mysql_query ( $querysearch ) or die($querysearch.mysql_error());

your get a better error report for debugging

[krio]

thanks again... These have been confusing me for some time now ! =D