search names and numbers syntax

[dflow]

i have this code

i am doing something wrong, i want only letters in the  Name search

$query = 'SELECT *
FROM apartments
INNER JOIN suppliers ON apartments . InternalSupplierID = suppliers . InternalSupplierID
WHERE ID LIKE '.$_POST['search'].'
OR SupplierID LIKE '.$_POST['search'].'
OR Name LIKE \' {^[[:alpha:]]+$}'.$_POST['search'].' {^[[:alpha:]]+$}\'';

[PaulRyan]

Would you totally be against PHP preg_replace?

 

If not then you can use this

  
  $searchTerm = preg_replace('/[^a-zA-Z]/','',$_POST['search']);

  $query = "SELECT *
  FROM apartments
  INNER JOIN suppliers ON apartments . InternalSupplierID = suppliers . InternalSupplierID
  WHERE ID LIKE '{$_POST['search']}'
  OR SupplierID LIKE '{$_POST['search']}'
  OR Name LIKE '%$searchTerm%'";

 

Regards, PaulRyan.

[Muddy_Funster]

OR Name LIKE \' {^[[:alpha:]]+$}'.$_POST['search'].' {^[[:alpha:]]+$}\'';

What is this supposed to do exactly?

 

You would be much better off using a preg_replace on your $_POST input to strip out anything that you want there (as PaulRyan has shown), and then enter it into the query. SQL isn't neerly as good at that type of data manipulation as PHP is.

[dflow]

Would you totally be against PHP preg_replace?

 

If not then you can use this

  
  $searchTerm = preg_replace('/[^a-zA-Z]/','',$_POST['search']);

  $query = "SELECT *
  FROM apartments
  INNER JOIN suppliers ON apartments . InternalSupplierID = suppliers . InternalSupplierID
  WHERE ID LIKE '{$_POST['search']}'
  OR SupplierID LIKE '{$_POST['search']}'
  OR Name LIKE '%$searchTerm%'";

 

Regards, PaulRyan.

 

search for Name still doesnt work

[Muddy_Funster]

what's it not doing / doing that it shouldnt?

[PaulRyan]

Do you get any errors? If so what are they?

 

If not, are you searching for something that actually exists?

Try changing the other variables to %$searchTerm% too?

 

If non of the above is the case try allowing spaces with the following

  $searchTerm =  preg_replace('/[^a-zA-Z\s]/','',$_POST['search']); 

 

Regards, PaulRyan.

[dflow]

Do you get any errors? If so what are they?

 

If not, are you searching for something that actually exists?

Try changing the other variables to %$searchTerm% too?

 

If non of the above is the case try allowing spaces with the following

  $searchTerm =  preg_replace('/[^a-zA-Z\s]/','',$_POST['search']); 

 

Regards, PaulRyan.

perfect thanks