April 2, 20179 yr At the moment this search script is working pretty well. However, how should I stop a single space from triggering all of the other search results because they have a space in them? if ($something == ' ') ? The script is below and you can test it here in the search field. <?php $to = "myemail@hotmail.com"; $subject = "Unfound Search Query"; $body = $_POST['search']; include("dbconnect.php"); if(!isset($_POST['search'])) { header("Location:index.html"); } $sql="SELECT * FROM text WHERE item LIKE '%".$_POST['search']."%'"; $qry=mysqli_query($dbconnect, $sql); if(mysqli_num_rows($qry)>0) { $rs=mysqli_fetch_assoc($qry); } if(mysqli_num_rows($qry)>0) { do { echo $rs['item']." - "; /*echo "Page: ".$rs['sitepage'];*/ echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>"; /*echo "<a href=\"".$rs['sitepage']."\">".$rs['sitepage']."</a>;*/ ?> </p> <?php } while ($rs=mysqli_fetch_assoc($qry)); } else { echo "No results found for '".$_POST['search']."'. Sorry about that."; /*echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>";*/ mail($to,$subject,$body); } ?> Edited April 2, 20179 yr by Grant Barker
April 2, 20179 yr If you wanna remove spaces simply do this $searchq = str_replace(' ','',$_POST['search']); then pass that variable to your query. However here is a few recommendations.. Use mysqli_real_escape_string to prevent mysql injections Research full text searching. Using LIKE on a large database can be quite slow Add exit; right after your header redirect. This is to prevent the rest of the script running just in case the redirection fails If you need anymore help feel free to ask or PM me
April 3, 20179 yr Author If you wanna remove spaces simply do this $searchq = str_replace(' ','',$_POST['search']); then pass that variable to your query. However here is a few recommendations.. Use mysqli_real_escape_string to prevent mysql injections Research full text searching. Using LIKE on a large database can be quite slow Add exit; right after your header redirect. This is to prevent the rest of the script running just in case the redirection fails If you need anymore help feel free to ask or PM me Thank you very much webdesigner93! I just saw this post before I pop back out to go to work. I will look into this tonight when I get home and apply as much of it as I can. Just to reiterate, when a single space is entered into the search field and the user presses search - it brings up all of the search items which have a search term which includes a space. For example PC doesn't have a space, so it only returns results which include the letters PC somewhere. But if you enter a single space and search, then it brings up most of the results because they have a space in them. Thanks a lot. I look forward to researching and following this up later. Have a good day. Edited April 3, 20179 yr by Grant Barker
April 3, 20179 yr Just to reiterate, when a single space is entered into the search field and the user presses search - it brings up all of the search items which have a search term which includes a space. For example PC doesn't have a space, so it only returns results which include the letters PC somewhere. But if you enter a single space and search, then it brings up most of the results because they have a space in them. I think you want to trim if i'm reading correctly? $search = " "; if($search!="") { // Will search as a space is 'something' so will search % % } if(trim($search)!="") { // Won't work as now the search is empty as it was just a space. }
April 3, 20179 yr Author Thanks BrowserBugs, Actually, I apologize to you and others here. It seems that I need to stop the search from working if the user enters only one character. So, if the user enters just a, or b, or c, or space, then no results are returned. Otherwise, like the single space, a single letter or character is bringing up too many results. I'd like the search to require a minimum of 2 characters, so I'll research minimum allowed number of characters. Sorry about that. EDIT: OK. So, I've added (and learned about) strlen in 2 places. I'm not sure if that's correct, but it seems to work in requiring more than 1 character before it brings up search results. I've also added the exit; which I'm hoping is in the right place. I will work on the mysqli_real_escape_string tomorrow after work. Thanks <?php $to = "myemail@hotmail.com"; $subject = "Unfound Search Query"; $body = $_POST['search']; include("dbconnect.php"); if(!isset($_POST['search'])) { header("Location:index.html"); exit; } $sql="SELECT * FROM text WHERE item LIKE '%".$_POST['search']."%'"; $qry=mysqli_query($dbconnect, $sql); if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)) { $rs=mysqli_fetch_assoc($qry); } if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)) { do { echo $rs['item']." - "; /*echo "Page: ".$rs['sitepage'];*/ echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>"; /*echo "<a href=\"".$rs['sitepage']."\">".$rs['sitepage']."</a>;*/ ?> </p> <?php } while ($rs=mysqli_fetch_assoc($qry)); } else { echo "No results found for '".$_POST['search']."'. Sorry about that."; /*echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>";*/ mail($to,$subject,$body); } ?> Edited April 3, 20179 yr by Grant Barker
April 3, 20179 yr Cool just remember that two blank spaces will still pass a strlen test. $test = " "; echo strlen($test); // Would return 2 echo strlen(trim($test)); // Would return 0 $test2 = " a b "; echo strlen($test2); // Would return 5 echo strlen(trim($test2)); // Would return 3 Also str_replace would ditch all spaces... $test2 = " a b "; echo str_replace(' ','',$test2); // Would return "ab" ... so searches for "james brown" would become "jamesbrown" ... might not be what you want. Edited April 3, 20179 yr by BrowserBugs
April 3, 20179 yr I think you want to trim if i'm reading correctly? $search = " "; if($search!="") { // Will search as a space is 'something' so will search % % } if(trim($search)!="") { // Won't work as now the search is empty as it was just a space. } Trim will actually just remove spaces from the beginning of a string and the end of a string it would not remove the middle space for something like searchword searchword Edit: Never mind I see what you were doing you were just seeing if the search box was empty all together Edited April 3, 20179 yr by webdesigner93
April 3, 20179 yr Thanks BrowserBugs, Actually, I apologize to you and others here. It seems that I need to stop the search from working if the user enters only one character. So, if the user enters just a, or b, or c, or space, then no results are returned. Otherwise, like the single space, a single letter or character is bringing up too many results. I'd like the search to require a minimum of 2 characters, so I'll research minimum allowed number of characters. Sorry about that. EDIT: OK. So, I've added (and learned about) strlen in 2 places. I'm not sure if that's correct, but it seems to work in requiring more than 1 character before it brings up search results. I've also added the exit; which I'm hoping is in the right place. I will work on the mysqli_real_escape_string tomorrow after work. Thanks <?php $to = "myemail@hotmail.com"; $subject = "Unfound Search Query"; $body = $_POST['search']; include("dbconnect.php"); if(!isset($_POST['search'])) { header("Location:index.html"); exit; } $sql="SELECT * FROM text WHERE item LIKE '%".$_POST['search']."%'"; $qry=mysqli_query($dbconnect, $sql); if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)) { $rs=mysqli_fetch_assoc($qry); } if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)) { do { echo $rs['item']." - "; /*echo "Page: ".$rs['sitepage'];*/ echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>"; /*echo "<a href=\"".$rs['sitepage']."\">".$rs['sitepage']."</a>;*/ ?> </p> <?php } while ($rs=mysqli_fetch_assoc($qry)); } else { echo "No results found for '".$_POST['search']."'. Sorry about that."; /*echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>";*/ mail($to,$subject,$body); } ?> If your checking for character length strlen is the way to go so you do have that part right but like mentioned before spaces are counted as a character so you would need to use str_replace from the previous examples to remove all spaces.
April 4, 20179 yr Author webdesigner93 and BrowserBugs, Thank you both very much! You have helped to teach me more than I expected, so thank you. Yes, sorry, I wasn't trying to change the search results or remove any spaces in the result string appearance. I just wanted to limit the amount of results that showed up. The image below shows the 'item' list in the database. For those who are learning like me, the search looks for similar characters from the 'item' list and then shows those results, but I didn't want just one character being found (especially a space if the user entered just a space) and then have too many results show up. So, searching for PC will bring up relevant choices, but searching for P won't bring up anything and the same for searching for a blank space. Thanks.
April 4, 20179 yr webdesigner93 and BrowserBugs, Thank you both very much! You have helped to teach me more than I expected, so thank you. Yes, sorry, I wasn't trying to change the search results or remove any spaces in the result string appearance. I just wanted to limit the amount of results that showed up. The image below shows the 'item' list in the database. For those who are learning like me, the search looks for similar characters from the 'item' list and then shows those results, but I didn't want just one character being found (especially a space if the user entered just a space) and then have too many results show up. So, searching for PC will bring up relevant choices, but searching for P won't bring up anything and the same for searching for a blank space. Thanks. This is why we use full text searching it is more accurate however you do need to have more than 3 results in your database for it to work an example of a full text search would be $query = mysqli_query($conn,"SELECT * FROM `table` WHERE MATCH(field) AGAINST('{$searchQ}')"); now for this to work you need to set a fulltext index on the field that is inside MATCH There is so much to know about fulltext searches i can't really explain it all here. But you can always do your own research
April 4, 20179 yr Thank you very much webdesigner93! No problem and for the love of god please take my advice and use mysqli_real_escape_string wrapped around your query variable. People can pass all types of nasty stuff to your query without it.
April 5, 20179 yr Author No problem and for the love of god please take my advice and use mysqli_real_escape_string wrapped around your query variable. People can pass all types of nasty stuff to your query without it. OK. Thanks. I'll look into how to do that and do it asap. Just in case my few visitors are unholy no gooders!
April 5, 20179 yr Author Hmm, To be honest, I'm not sure how to apply mysqli_real_escape_string correctly in my situation. Quite a few mysqli_real_escape_string video tutorials are showing scripts which are using the GET method in them for username and password, which seem simple enough to know and see where to apply the escape string. I tried using either one of these (one at a time), but it breaks my script or doesn't work. I don't like asking to have my hand held, but I'd appreciate the heads up or at least a strong clue, please. (Still using the script above.) $search = mysqli_real_escape_string ($dbconnect, $_POST['search']); or $sql="SELECT * FROM text WHERE item LIKE '%".mysqli_real_escape_string ($_POST['search'])."%'"; Edited April 5, 20179 yr by Grant Barker
April 5, 20179 yr Author No problem and for the love of god please take my advice and use mysqli_real_escape_string wrapped around your query variable. People can pass all types of nasty stuff to your query without it. You mean wrapped around this part, right? $sql="SELECT * FROM text WHERE item LIKE '%".$_POST['search']."%'";
April 5, 20179 yr Author I think it might be OK now. Could you please check the script below, and or even test it please? Thanks a lot. Here is the latest script: <?php $to = "myemail@hotmail.com"; $subject = "Unfound Search Query"; $body = $_POST['search']; include("dbconnect.php"); if(!isset($_POST['search'])) { header("Location:index.html"); exit; } $sql="SELECT * FROM text WHERE item LIKE '%".mysqli_real_escape_string ($dbconnect, $_POST['search'])."%'"; $qry=mysqli_query($dbconnect, $sql); if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)){ $rs=mysqli_fetch_assoc($qry); } if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)) { do { echo $rs['item']." - "; /*echo "Page: ".$rs['sitepage'];*/ echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>"; /*echo "<a href=\"".$rs['sitepage']."\">".$rs['sitepage']."</a>;*/ ?> </p> <?php } while ($rs=mysqli_fetch_assoc($qry)); } else { echo "No results found for '".$_POST['search']."'. Sorry about that."; /*echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>";*/ mail($to,$subject,$body); } ?> Edited April 5, 20179 yr by Grant Barker
April 6, 20179 yr I think it might be OK now. Could you please check the script below, and or even test it please? Thanks a lot. Here is the latest script: <?php $to = "myemail@hotmail.com"; $subject = "Unfound Search Query"; $body = $_POST['search']; include("dbconnect.php"); if(!isset($_POST['search'])) { header("Location:index.html"); exit; } $sql="SELECT * FROM text WHERE item LIKE '%".mysqli_real_escape_string ($dbconnect, $_POST['search'])."%'"; $qry=mysqli_query($dbconnect, $sql); if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)){ $rs=mysqli_fetch_assoc($qry); } if((mysqli_num_rows($qry)>0) and (strlen($_POST['search'])>=2)) { do { echo $rs['item']." - "; /*echo "Page: ".$rs['sitepage'];*/ echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>"; /*echo "<a href=\"".$rs['sitepage']."\">".$rs['sitepage']."</a>;*/ ?> </p> <?php } while ($rs=mysqli_fetch_assoc($qry)); } else { echo "No results found for '".$_POST['search']."'. Sorry about that."; /*echo "<a href=\"".$rs['pagelink']."\">".$rs['pagelink']."</a>";*/ mail($to,$subject,$body); } ?> Checks out ok you can test yourself by simply entering some quotes like ' ' " " if it does not break the script mysqli_real_escape_string is doing it's job properly Edited April 6, 20179 yr by webdesigner93
April 6, 20179 yr Author Checks out ok you can test yourself by simply entering some quotes like ' ' " " if it does not break the script mysqli_real_escape_string is doing it's job properly Thanks very much! It seems to check out OK. Much appreciated.
Create an account or sign in to comment