Question

I have a table with 4 record.

Records: 1) arup Sarma
         2) Mitali Sarma
         3) Nisha
         4) haren Sarma

And I used the below SQL statement to get records from a search box.

$sql = "SELECT id,name FROM ".user_table." WHERE name LIKE '%$q' LIMIT 5";

But this retrieve all records from the table. Even if I type a non-existence word (eg.: hgasd or anything), it shows all the 4 record above. Where is the problem ? plz any advice..

This is my full code:

$q = ucwords(addslashes($_POST['q']));
$sql = "SELECT id,name FROM ".user_table." WHERE name LIKE '%".$q."' LIMIT 5";
$rsd = mysql_query($sql);

Answer 1

Your query is fine. Your problem is that $q does not have any value or you are appending the value incorrectly to your query, so you are effectively doing:

"SELECT id,name FROM ".user_table." WHERE name LIKE '%' LIMIT 5";