Question

I am going to use a form to send a keyword to the page itself, via url get, to be applied in a sql statement for keyword search purpose:-

if (isset($_GET['k']))
{
$keyword = $_GET['k'];
$keyword = urldecode($keyword);
}

<form action = "home.php" method="get">
<input type = "text" name="k" value = "" size = "40"/>
<input type = "submit" value = "search">
</form>

$sql = "select * from [phone] where ([name] like '%$keyword%') order by id DESC";

for english contents, I can get the keyword from URL perfectly; but for chinese characters, although I have applied urldecode to the $_GET value, I still cannot recover the chinese word. Is there any better way for the problem? Thanks!

Answer 1

Normally, you dont have to use urldecode, when revieving a GET-value.

In addition to that, you have a nasty SQL-Injection issue:

$sql = "select * from [phone] where ([name] like '%$keyword%') order by id DESC";

change to (if mysql):

$sql = sprintf("select * from [phone] where ([name] like '%%%s%%') order by id DESC", mysql_real_escape_string($keyword));

Better use prepared statements, or something like Zend_DB_Select.