Question

So I am try ing to create a MySQL command to search a table. What I want it to do is:

My table has 4 columns: id, categories, brands, names.

In php/html
on the search page the user selects a category from a dropdown. This is the category so this is posted as category to the search page. then thy type in a keyword into the text box. This is posted keyword to the search page.

I want to make a MySQL command that selects the category in categories posted then searches those selected rows for my posted keyword in the brands, and names columns

Here is what I have tried:

"SELECT brands, names 
   FROM tableName 
  WHERE categories LIKE".$_GET['category']." 
    AND (brands LIKE ".$_GET['keyword']." 
     OR names LIKE ".$_GET['keyword'].");";

Answer 1

You need quotes around strings in SQL. Try this:

"SELECT brands, names 
   FROM tableName 
  WHERE categories LIKE '".$_GET['category']."' 
    AND (brands LIKE '".$_GET['keyword']."' 
         OR names LIKE '".$_GET['keyword']."');";

Unless you are expecting there to be variations e.g. several words with the same beginning, using LIKE doesn’t achieve much. If you are expecting this, you need to use wildcards to specify where you expect the variance to be e.g.

brands LIKE '".$_GET['keyword']."%' 
// User enters 'Mc', SQL end up as:
brands LIKE 'Mc%'
// Columns matched: 'McDonalds' 'McHenry'

More examples here.

If you don’t want to allow for this, just use = instead of LIKE.

You also need to sanitise these variables first using a regular expression or similar, as this would currently allow someone to attack your server with SQL injection.