Question

I have a form where a user can type in the firstname to search, my query is not returning the correct results, what am I doing wrong?

$sfn = $_POST["Text1"];
$sql = "SELECT * FROM ex_usrs WHERE firstname LIKE '$sfn'";
...

Answer 1

Your query will only return rows where firstname is equal to $_POST["Text1"]. When you use LIKE you can use a wildcard (%) to represent any number of characters.

• This will find rows where firstname starts with $_POST["Text1"].

  SELECT * FROM ex_usrs WHERE firstname LIKE '$sfn%'
  

• This will find rows where firstname ends with $_POST["Text1"].

  SELECT * FROM ex_usrs WHERE firstname LIKE '%$sfn'
  

• This will find rows where firstname contains $_POST["Text1"].

  SELECT * FROM ex_usrs WHERE firstname LIKE '%$sfn%'
  

Note: Never use variables from $_POST without escaping them first. What if I searched for "O'Neil" (or worse "'; DROP TABLE ex_users; -- ")?