Question

I am trying to make a query that will take the inputted items and search the database. I know how I have done it several times, but this query just does not want to work.

This is the query

$getcamp = $db->query("SELECT * FROM `campaigns` 
WHERE `requirements` LIKE '%$keyw%' OR `description` LIKE '%$keyw%' OR `name` 
LIKE '%$keyw%' OR `countries` LIKE '%$country%' OR `id` LIKE '%$camp%' OR `category` 
LIKE '%$cat%' AND `active` = '1' ORDER BY `added`") 

or die($db->error);

There are a lot of OR breaks, and I have tried wrapping then in parenthesis in several different variations, but the query still will not work, and there are no errors, it just still shows everything in table instead of what was searched. I am not the best with these kinds of queries as normally I am only writing to search 1 or 2 items, this one is searching for a lot.

If I were to only be searching for the first 3 in that statement it will work fine, but once I start adding onto it is when it breaks, even if I put parenthesis around the first 3, I am just not sure what I am doing wrong.

Also just a side note my host doesn’t have mysqlnd support that’s why I am not using a prepared statement but my variables are escaped before hand.

Answer 1

If one of your variables is empty, it will select all the rows.

You should do the following (this is a basic example so you understand the idea):

$orArray = array();
$orQuery = "";
if (!empty($keyw) && strlen($keyw) > 2) { // and other SQL injection checks
    $orArray[] = "`requirements` LIKE '%{$keyw}%' ";
}

if (!empty($orArray())) {
    $orQuery = implode(' OR ', $orArray);
}

$query = "SELECT * FROM `campaigns` WHERE ( {$orQuery} ) AND active = 1 "; 
// You also should check if $orQuery is empty, if it is, you need to remove AND. 
// Well, in that case you wouldn't do the query at all.

Something like this should do, but you need to make the checks for every variable.

PS: I recommend to set a minimum for string search (3 is a good starting point).

PS2: This may not be the problem, but I’m pointing it out because it’s a flaw in your scripts logic.