I've read various sources but I'm unsure how to implement them into my code. I was wondering if somebody could give me a quick hand with it? Once I've been shown how to do it once in my code I'll be able to pick it up I think! This is from an AJAX autocomplete I found on the net, although I saw something to do with it being vulnerable to SQL Injection due to the '%$queryString%' or something? Any help really appreciated!
if ( isset( $_POST['queryString'] ) )
{
$queryString = $_POST['queryString'];
if ( strlen( $queryString ) > 0 )
{
$query = "SELECT game_title, game_id FROM games WHERE game_title LIKE '%$queryString%' || alt LIKE '%$queryString%' LIMIT 10";
$result = mysql_query( $query, $db ) or die( "There is an error in database please contact [email protected]" );
while ( $row = mysql_fetch_array( $result ) )
{
$game_id = $row['game_id'];
echo '<li onClick="fill(\'' . $row['game_title'] . '\',' . $game_id . ');">' . $row['game_title'] . '</li>';
}
}
}