php search function

Question

I am attempting to create a search function for user profiles on my site.

$search= $_POST['search'];
$res=mysql_query("SELECT * FROM ".TBL_USERS." WHERE username LIKE '$search%'");

This is the code I use. This will only work if you search something that matches the start of the result. Is there any way I can return values that have what i type as part of the username regardingless of upper or lower cases?

Thankyou

Answer 1

You should really add some sort of data cleansing, you should never take raw post/get data and insert it directly into a query.

With that said:

$search= strtolower($_POST['search']);
$res=mysql_query("SELECT * FROM ".TBL_USERS." WHERE LOWER(username) LIKE '$search%'");

Answer 2

As you are using LIKE you can use the % wildcard on both sides of the input, this will return any users where $search is part of the username.

You may also want to look at MySQLs REGEXP function

$search= mysql_real_escape_string($_POST['search']);
$res=mysql_query("SELECT * FROM ".TBL_USERS." WHERE username LIKE '%" . $search . "%'");

Answer 3

"%" is the wildcard, so if you also place it in front of your search string (like %$search%) it will match $search anywhere in username.

Use "LOWER" in SQL to make your username lowercase and "strtolower" in PHP to do the same, then execute the query to get case-insensitive results.

And as David Dorward said: read bobby-tables.com before you do anything else!!!

Answer 4

You need to read about the terms "SQL Injection" and "PHP Prepared Statements" - Google for them... This is FAR more important that the question you have asked.

But since you ask, try the comparison all in upper case...

Martin.