Question

I have made an normal form that you can enter a user´s fullname in and choose sex.

Now to the PHP for the searching in the database.

$full_name = mysql_real_escape_string($_POST["search"]);
$sex = mysql_real_escape_string($_POST["sex"]);
list($firstname, $lastname) = array_map('ucfirst', explode(' ', $full_name));
        $query = "SELECT firstname, lastname, id, user_name, sex, last_access, bostadsort FROM users WHERE firstname LIKE '$firstname' OR lastname LIKE '$lastname' AND sex = '$sex'"; 
    $result1 = mysql_query($query) or die(mysql_error());
    $count = mysql_num_rows($result1);
echo $count;

If i enter Jenni Jackson (that exists) and choose “male”, i still get 1 in $count, but Jenni Jackson is a female, and has female in the sex column.. I tried do echo $sex to see the value of $sex if it really is what you chose in the form, and it is correct.

Answer 1

You need to use parenthesis in your query as:

WHERE (firstname LIKE '$firstname' OR lastname LIKE '$lastname') AND sex='$sex'";

without the parenthesis your query is equivalent to:

WHERE firstname LIKE '$firstname' OR (lastname LIKE '$lastname' AND sex='$sex')";

and since firstname condition matches, the row is returned.

This happens because AND is having precedence over OR