Search function incomplete

Question

I am implementing a search function on a web site.

There is a field called nombre_ciudad and a value for this field is "Ciudad Juárez".

I need to search for the term "Ju" and now it doesn't work.

This is the part of the code that I am using now:

$sql.=" OR nombre_ciudad LIKE '".$requestData['search']['value']."%' ";

The search works for terms like "Ciudad Juarez", "C", "ciudad", but not for "arez" or "rez"

The documentation has an explanation of what the different wildcard characters represent. http://dev.mysql.com/doc/refman/5.7/en/string-comparison-functions.html#operator_like — Don't Panic, Jun 20 '16 at 19:55

score 3 · Accepted Answer · edited May 23 '17 at 10:33

3

you are missing the wildcard character % at the start of the pattern
you are vulnerable to SQL injection, see: How can I prevent SQL injection in PHP?

edited May 23 '17 at 10:33

Community

1
1

answered Jun 20 '16 at 19:53

ShiraNai7

6,129
2
23
26

score 1 · Answer 2 · answered Jun 20 '16 at 19:55

The % symbol in MySQL acts as a wildcard. If I'm trying to search for ciudad, and I type in LIKE '"da%"', I would get back all entries that start with da, and have any ending after that, including dad. In order to search before and after your query, you need to place a wildcard before and after, like this:

OR nombre_ciudad LIKE '%da%';

Search function incomplete

2 Answers2