Question

Please help me with this syntax. Is this correct?

$query = mysql_query("SELECT * FROM axispl WHERE companyname LIKE $searchterm% LIMIT 11");

In few examples on the net I have seen ` symbol being used to enclose axispl or companyname. In few they are not present. What is the difference?

My database has 2 columns. First has company names. Second has the category they fall in to. I basically want the query to select 11 of these pairs when the company name matches the searchterm.

Should I mention SELECT * or should I mention SELECT companyname, axiscategory ? (these are the names of the two columns).

If the above syntax is not correct, what should I change?

Answer 1

You need to quote the search term with single quotes.

$query = mysql_query("SELECT * FROM axispl WHERE companyname LIKE '".mysql_real_escape_string($searchterm)."%' LIMIT 11");

It does not really matter if you use SELECT * or specify the columns – the latter is usually a little bit faster but it usually doesn’t matter if you need all columns anyway.

Regarding your quoting question:

• Always escape strings you pass into a query.
• Use single quotes to quote strings used in a query
• Backticks are used to quote database/table/column names and only necessary if they collide with reserved keywords.