Thread: Loosing it
View Single Post

  #2 (permalink)  
Old 01-08-2005
George
 
Posts: n/a
Default Re: Loosing it

Hi,

$query = "select * from table_1 where dane (like '%$search%') or dane
(like
'%search1%')";

well first of all you dont have $ in front of the search1 variable.
also, why put the brackets there? this should be:

$query = "select * from table_1 where dane like '%$search%' or dane
like
'%search1%'";

not only that, but this query should be further improved to:

$query = "select * from table_1 where dane like '%".$search."%' or dane
like
'%".$search1."%'";

and you should always make sure that the variables you pass into the
query are escaped (the default setting of magic quotes varies from host
to host).

George

Reply With Quote