Grouping multiple like statements

Question

I'm new to SQL can't seem to group multiple LIKE statements together. Any idea what I am doing incorrectly?

$query = mysqli_query($mysqli, "SELECT * FROM table_name
            WHERE Page LIKE ".$page."
            AND Profession LIKE ".$profession.", 
            AND Age LIKE ".$age."");

Thanks.

What is going wrong? Do you have an error or do you have wrong result? — Hamlet Hakobyan, May 29 '14 at 16:16
When using `mysqli` you should be using parameterized queries and [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add user data to your query. **DO NOT** use string interpolation to accomplish this because you will create severe [SQL injection bugs](http://bobby-tables.com/). You shouldn't have to concern yourself with quoting issues. — tadman, May 29 '14 at 16:17
what's the point of using mysqli when you create your query like that, without bindings. — user2009750, May 29 '14 at 16:17
@ɢʜʘʂʈʀɛɔʘɴ The point is someone being a newbie moving from `mysql_*` extensions to `mysqli_*` extensions & learning the basics. It’s not invalid at all. — Giacomo1968, May 29 '14 at 16:23
you should not use comma after and so remove comma after '$profession.' — Ezhil, May 29 '14 at 16:24

score 1 · Accepted Answer · edited May 29 '14 at 16:30

Its likely because they are not enclosed correctly

$query = mysqli_query($mysqli, "SELECT * FROM table_name
            WHERE Page LIKE ".$page."
            AND Profession LIKE ".$profession."
            AND Age LIKE ".$age."");

when compiled is something like

SELECT * FROM table_name
            WHERE Page LIKE page number 1
            AND Profession LIKE my profession
            AND Age LIKE 100

which is invalid SQL

You need to use quotes and escape the values

$query = mysqli_query($mysqli, "SELECT * FROM table_name
            WHERE Page LIKE '%".$page."%'
            AND Profession LIKE '%".$profession."%'
            AND Age LIKE '%".$age."%'");

would give

SELECT * FROM table_name
            WHERE Page LIKE '%page number 1%'
            AND Profession LIKE '%my profession%'
            AND Age LIKE '%100%'

Which will likely give a result of what you would expect

Make sure the values are safe though by at bare minimum using http://www.php.net/manual/en/mysqli.real-escape-string.php though looking at prepared statements would be a better option

Edit:

Remove comma after LIKE ". $profession."

Works great, but appears to be very slow. It takes about 2 seconds to query a 10 row column. — Mark Biwojno, Jun 03 '14 at 21:47
http://stackoverflow.com/questions/2042269/how-to-speed-up-select-like-queries-in-mysql-on-multiple-columns — exussum, Jun 03 '14 at 21:49

score 0 · Answer 2 · answered May 29 '14 at 16:19

This would be a lot easier to get right if you use placeholders and bind_param:

$stmt = mysqli_query($mysqli, "SELECT * FROM table_name
            WHERE Page LIKE ?
            AND Profession LIKE ?
            AND Age=?");

mysqli_stmt_bind_param($stmt, 'ssi', "%" . $page . "%", "%" . $profession. "%", $age);

mysqli_stmt_execute($stmt);

Grouping multiple like statements

2 Answers2