SQL query condition not working

Question

I'm working on a search script with pagination but can't get it to work properly.

Here is my query:

$query = "SELECT COUNT(*) FROM server_data WHERE trash = '0' AND server_address LIKE '%$search%' OR title LIKE '%$search%' OR short_desc LIKE '%$search%'";

This is to count how many results there are in the database.

Here is my query for the actual data:

$query = "SELECT * FROM server_data WHERE trash = '0' AND server_address LIKE '%$search%' OR title LIKE '%$search%' OR short_desc LIKE '%$search%' ORDER BY id DESC $limit";

For some reason, this is returning results where trash = 1 and trash = 0, when it should only be returning where trash = 0 obviously. Anybody have any idea why this could be happening?

WHERE trash = '0' AND (server_address LIKE '%$search%' OR title LIKE '%$search%' OR short_desc LIKE '%$search%') ORDER BY id DESC $limit"; — Mike Christensen
– Mike Christensen, Commented Aug 17, 2014 at 19:35

MrTux · Accepted Answer · 2014-08-17 19:36:06Z

1

Use parenthesis

$query = "SELECT * FROM server_data WHERE trash = '0' AND (server_address LIKE '%$search%' OR title LIKE '%$search%' OR short_desc LIKE '%$search%') ORDER BY id DESC $limit";

Without parenthesis your query is evaluated as follows:

$query = "SELECT * FROM server_data WHERE (trash = '0' AND server_address LIKE '%$search%') OR title LIKE '%$search%' OR short_desc LIKE '%$search%' ORDER BY id DESC $limit";

The reason for this is that AND is "strong" than OR (it's like in math where multiplication is stronger than addition: 3*5+3=15+3=18).

Btw. please make sure $search is properly escaped, otherwise you allow SQL injection.

answered Aug 17, 2014 at 19:36

MrTux

34.4k30 gold badges120 silver badges158 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Caden Grant Over a year ago

Would using a prepared statement be good enough as far as preventing SQL injection?

MrTux Over a year ago

Yes, that would fix this. Maybe also $limit has to be handled (at least casted to int).

Collectives™ on Stack Overflow

SQL query condition not working

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related