Search Query Didn't Work Well

Question

I got a problem will using the search. I want to show it like this if I didn't put a word:

Not found

And the code is like this:

<?php
    error_reporting(0);

    $search = trim($_POST["search"]);
    $search = htmlentities(htmlspecialchars($search), ENT_QUOTES);

    $select = "SELECT * FROM articleWHERE article_title LIKE '%" . $search . "%' ORDER BY id_artikel DESC LIMIT 12";
    $query = mysql_query($select);
    $num = mysql_num_rows($query);

    if ($num > 0) {
        while ($fetch = mysql_fetch_array($query)) {
                echo '<div class="row">';
                echo '    <div class="col-md-4">';
                echo '        <div class="news-post standard-post2">';
                echo '            <div class="post-gallery">';
                echo '                <img src="#" alt="">';
                echo '                <a class="category-post world" href="#">Business</a>';
                echo '            </div>';
                echo '            <div class="post-title">';
                echo '                <h2><a href="#">' . $fetch["article_title"] . '</a></h2>';
                echo '                <ul class="post-tags">';
                echo '                    <li><i class="fa fa-clock-o"></i>' . date("d F Y") . '</li>';
                echo '                    <li><i class="fa fa-user"></i>by <a href="#">' . $fetch["writer"] . '</a></li>';
                echo '                    <li><a href="#"><i class="fa fa-comments-o"></i>23</a></li>';
                echo '                    <li><i class="fa fa-eye"></i>' . $fetch["read"] . '</li>';
                echo '                </ul>';
                echo '            </div>';
                echo '            <div class="post-content">';
                echo '                <p>' . substr(strip_tags($fetch["content"]), 0, 150) . "..." . '</p>';
                echo '                <a href="artikel.php" class="read-more-button"><i class="fa fa-arrow-circle-right"></i>Read More</a>';
                echo '            </div>';
                echo '        </div>';
                echo '    </div>';
                echo '</div>';
         }
     } else {
          echo '<p align="center">Not Found</p>';
     }
?>

If I didn't put a word on the search form it didn't show the "not found". Please let me know how I go about doing it.

Looks correct to me. What's the problem are you facing? And please do not use `mysql_*` functions. They are deprecated. — Praveen Kumar Purushothaman, Jul 06 '16 at 17:03
Be aware this code is vulnerable to a SQL Injection attack: http://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work?lq=1 — Jeremy Harris, Jul 06 '16 at 17:04
Ah, and you have a space missing between the `article` and `WHERE`. See: `articleWHERE`. — Praveen Kumar Purushothaman, Jul 06 '16 at 17:04
@AnandaRizkyKurniawan What's the problem are you facing? What's happening? — Praveen Kumar Purushothaman, Jul 06 '16 at 17:05
@AnandaRizkyKurniawan Remove the `error_reporting(0);` to show you if there are any errors in the code. — Praveen Kumar Purushothaman, Jul 06 '16 at 17:05
@PraveenKumar if i didn't put a word on the search form it didn't show "not found" — kurniadi455, Jul 06 '16 at 17:07

score 0 · Accepted Answer · edited May 23 '17 at 12:16

If I didn't put a word on the search form it didn't show the "not found".

Just change the if condition to exclude empty:

if ($num > 0 && strlen($search) > 0) {

The possible reason why it doesn't show is, when you search for %% it includes all the rows so it is technically good search.

Also, please don't use mysql_* functions, as they are deprecated. Either switch to PDO or mysqli_* functions. See Why shouldn't I use mysql_* functions in PHP?

And your code is very much vulnerable to SQL Injection Attack. See: How does the SQL injection from the "Bobby Tables" XKCD comic work?

Search Query Didn't Work Well

1 Answers1