How to catch empty query in php

Question

I have several articles in my db and search on my site. if the user does not enter anything and click search, then displays all articles. How to catch empty request?

Code:

<?php
mysql_connect("localhost", "user", "password") or die("Error");
mysql_select_db("selv_hram") or die("Error");
mysql_query('SET names "utf8"');

if (isset($_POST['search'])) {
    $searchq = $_POST['search'];
    $searchq = htmlspecialchars($searchq);      

    $query = mysql_query("SELECT * FROM articles WHERE title LIKE '%$searchq%' OR text_article LIKE '%$searchq%'");
    $count = mysql_num_rows($query);
    $output = '';

    if ($count == 0) {
        $output = 'Nothing find';
    }else {
        while ($row = mysql_fetch_array($query)) {
            $title = $row['title'];
            $text = $row['text_article'];
            $id = $row['id'];

            $output .= '<div>'.$title.' '.$text.'</div>';
        }
    }
}   
?>

    <div class="content-article">
        <form name="search" action="index.php" method="post" class="search-form">
        <input type="text" name="search" placeholder="search" />
        <input type="submit" value=">>">
        <?php print("$output"); ?>
    </div>

What do you mean by empty query ? You are already checking that `$row` is not empty with `$count` — Unex, May 19 '16 at 15:06
Stop using **mysql_*** functions. They are obsolete and unsafe. — Peon, May 19 '16 at 15:07
Use Javascript to make sure the search field has a value before the form is posted. — Patrick Q, May 19 '16 at 15:08
@PatrickQ never ever rely only on front-end validation. EVER. — Peon, May 19 '16 at 15:09
@DainisAbols never ever assume that a comment is intended to be an all-encompassing answer to a question. EVER. — Patrick Q, May 19 '16 at 15:10
Use both javascript validation and php validation, plus like already said your query is open to sql injection, use something like PDO at least. — job3dot5, May 19 '16 at 15:10

score 2 · Accepted Answer · edited May 23 '17 at 11:44

2

After you read this post about SQL-injection, change

if (isset($_POST['search'])) {

to

if (!empty($_POST['search'])) {

edited May 23 '17 at 11:44

Community

1
1

answered May 19 '16 at 15:07

fislerdata

290
1
4
8

3

Or just `!empty($_POST['search'])` – Peon May 19 '16 at 15:08
2

that can be narrowed down to a simple `!empty()` but your answer will work as per your original http://stackoverflow.com/revisions/37327273/1 – Funk Forty Niner May 19 '16 at 15:08
You don't need isset() as empty() is designed to not throw errors if the variable does not exist. – Edward May 19 '16 at 15:10
Thanks - I changed it to `!empty($_POST['search'])` – fislerdata May 19 '16 at 15:11
you could have added to it, your original answer would also have been valid http://stackoverflow.com/revisions/37327273/1 – Funk Forty Niner May 19 '16 at 15:11
Why just isset? that won't check if the search has value – Peon May 19 '16 at 15:11
1

@DainisAbols `if (isset($_POST['search']) and strlen($_POST['search']) > 0)` as per [the original answer](http://stackoverflow.com/revisions/37327273/1) is valid. I agree that just `isset()` isn't the best but it's still valid. `empty()` is better, yet using `strlen($_POST['search']) > 0)` is equivalent to checking if the POST is not empty. Quite a few other ways to go about it, but the answer has been edited. – Funk Forty Niner May 19 '16 at 15:14
I know, it was correct at start and got edited wrong – Peon May 19 '16 at 15:16

score 0 · Answer 2 · answered May 19 '16 at 15:09

0

This is simple validation.

if(empty($_POST['search'])) {
    echo "Empty search query"; 
} else {
    //search query
}

answered May 19 '16 at 15:09

Edward

1,806
5
26
36

score 0 · Answer 3 · answered May 19 '16 at 15:10

Check the user input first, if it is empty change the query. like below

 $searchq = htmlspecialchars($searchq);
 if(trim($searchq) == ''){
  $query = mysql_query("SELECT * FROM articles");
 }else{
   $query = mysql_query("SELECT * FROM articles WHERE title LIKE '%$searchq%' OR text_article LIKE '%$searchq%'");
 }

Dont use depreciated mysql_ functions. Go for mysqli

How to catch empty query in php

3 Answers3