failed to search using preg_match in a query php in html form

[admien]

Lets say you have the following values:

1341 
1234
4567 
12 
1

I'm trying to right a preg_match which will only return true for '34' thus only matching if 2 digits. This is what I have, but it is also matching 1341 and 1234. I may have something after it too.

currently my query is as follows:

 

if(isset($_GET['search'])){
	   $cari = $_GET['search'];
	   $data = mysqli_query($con,"select ***
where (table1.test2 =  '%".$search."%' or left(table1.test3,3) =  '%".$search."%')
				and date(table.created_date) = '" .$today. "'"

but after I change to this following:

if(isset($_GET['search'])){
	   $cari = $_GET['search'];
	   $data = mysqli_query($con,"select ***
where (table1.test2 =  preg_match('/^[0-9]{3}$/',$search) or left(table1.test3,3) = preg_match('/^[0-9]{3}$/',$search);)
				and date(table.created_date) = '" .$today. "'"

failed. do you have any idea how to construct the preg_match ?

[mac_gyver]

3 hours ago, admien said:

currently my query is as follows:

wildcard characters % and _ are only used with a LIKE comparison in a query. if your first query produces any result, it means that you managed to store the % characters in with the data in the database table.

3 hours ago, admien said:

but after I change to this following:

preg_match() is a php function. you cannot put it a query to match data in the database table. this query would be producing an sql error. are you using exceptions for errors for the sql queries (this is the default setting now in php8+)?

MySql does have regular expressions. see this link - https://dev.mysql.com/doc/refman/8.4/en/regexp.html

the regex pattern you came up with matches a string with exactly 3 decimal digits. your stated example is to match 2 digits. which is it and can it vary?

what exactly is the overall top-level task you are trying to accomplish, because using regex pattern matching is slow and cannot use indexes, so is a poor choice when you have large amounts of data?

lastly, do NOT put dynamic data values directly into sql queries, where any sql special character in a value can break the sql query syntax. use a prepared query instead. if it seems like using the mysqli extension is overly complicated and inconsistent, especially when dealing with prepared queries, it is. this would be a good time to switch to the much simpler and better designed PDO extension.

Edited 19 hours ago by mac_gyver