Question

I have two questions regarding my script and searching. I have this script:

$searchTerms = explode(' ', $varSearch);
$searchTermBits = array();
foreach($searchTerms as $term){
    $term = trim($term);
    if(!empty($term)){
        $searchTermBits[] = "column1 LIKE '%".$term."%'";
    }
}

$sql = mysql_query("SELECT * FROM table WHERE ".implode(' OR ', $searchTermBits)."");

I have a column1 with a data name “rock cheer climbing here”

If I type in “rock climb” this data shows. Thats perfect, but if I just type “Rocks”, it doesn’t show. Why is that?

Also, How would I add another “column2” for the keyword to search into?

Thank you!

Answer 1

Searching that string for “rocks” doesn’t work, because the string “rocks” doesn’t exist in the data. Looking at it, it makes sense to you, because you know that the plural of “rock” is “rocks”, but the database doesn’t know that.

One option you could try is removing the S from search terms, but you run into other issues with that – for example, the plural of “berry” is “berries”, and if you remove the S, you’ll be searching for “berrie” which doesn’t get you any further.

You can add more search terms by adding more lines like

$searchTermBits[] = "column1 LIKE '%".$term."%'";

and replacing ".$term." with what you want to search for. For example,

$searchTermBits[] = "column1 LIKE '%climb%'";

One other thing to note… as written, your code is susceptible to SQL injection. Take this for example… What if the site visitor types in the search term '; DROP TABLE tablename; You’ve just had your data wiped out.

What you should do is modify your searchTermBits[] line to look like:

$searchTermBits[] = "column1 LIKE '%" . mysql_real_escape_string($term) . "%'";

That will prevent any nastiness from harming your data.