creating a search form

[dudleylearning]

Hi,

 

so I've had an attempt at creating a search form I can get data from it so that's a positive. This is the relevant snippet:

$joke_text_search = $_REQUEST['text'];
$joke_text = '%' . $joke_text_search . '%';
$search  = $dbConnection->prepare("SELECT * FROM joke WHERE joke_text LIKE ?");
$search->execute([$joke_text]);
$result = $search->fetchAll();	

but if I type in % it shows all the data. Having a read of the PHP manual, seems that I should use str_replace. I have had an attempt with it but the % symbol still shows all the data:

$joke_text_search = $_REQUEST['text'];
$joke_text_search_filter = str_replace(array('%','_'),'',$joke_text_search);
$joke_text = '%' . $joke_text_search_filter . '%';
$search  = $dbConnection->prepare("SELECT * FROM joke WHERE joke_text LIKE ?");
$search->execute([$joke_text]);
$result = $search->fetchAll(); 

Could someone lend a hand?

 

[Barand]

Of course it does. "%" is the wildcard character which matches anything.

 

It's like searching a directory for *.* - you get all the files.

[Jacques1]

Having a read of the PHP manual, seems that I should use str_replace.

 

Yes, but you also need to understand what to replace the percent character with. Right now, you're replacing it with an underscore which stands for “exactly one arbitrary character”. Obviously that doesn't help.

 

If you want percent characters to be interpreted literally, you need to escape them with backslashes:

$search = '%'.str_replace('%', '\\%', $_GET['text']).'%';

[dudleylearning]

Of course it does. "%" is the wildcard character which matches anything.

 

It's like searching a directory for *.* - you get all the files.

 

ok, didn't know that. thanks for the tip. I tried it in another commercial website and it gave all the data 

[dudleylearning]

 

Yes, but you also need to understand what to replace the percent character with. Right now, you're replacing it with an underscore which stands for “exactly one arbitrary character”. Obviously that doesn't help.

 

If you want percent characters to be interpreted literally, you need to escape them with backslashes:

$search = '%'.str_replace('%', '\\%', $_GET['text']).'%';

 

that worked like a charm, exactly what I wanted. thanks Jacques1.