Member Avatar for Amaina

I'm at my wits end, perhaps after working non stop for 7 hrs. I'm trying to develop a simple search engine using Php and Mysql. I have borrowed my idea of doing this from a wonderful youtube tutorial by nick frosty. Unlike Nick, i'm not doing this the procedural way rather the PDO way. I know this kinda question has been asked here before (as they say nothing new under the sun) but personally cannot figure why my results are not showing. here is the code snippet

<!DOCTYPE HTML>
<html>
<form action="" method="get">
<input type="text" name="search" value="<?php echo $_GET['search'] ?>"/>
<input type="submit"  value="search">
</form>
results<hr />
<?php
include $_SERVER['DOCUMENT_ROOT'] . '/data.php';
    if(isset($_GET['search'])){
        $searchquery = $_GET['search'];

        $searchquery = explode(' ', $searchquery);
        $i=0;
        $query = "SELECT * FROM manuscript WHERE ";
        print_r($searchquery);
        foreach($searchquery as $term){
            $i++;
            if($i == 1){
                $query .= "title LIKE '%$term%' ";
            }
            else{
                $query .= "OR title LIKE '%$term%' ";
            }


        }

echo "$query <br>";

//connect

$con = dbConnect();

$query = $con->prepare($query);
$query->execute();
$query->setFetchMode(PDO::FETCH_ASSOC);

            while ($row = $sql->fetch()){
                $manuscript_id = $row ['manuscript_id'];

                $title = $row['title'];
                echo "$title yesu <br>";
            }
//
$con = null;
}
 ?>

   </html>
  • 3 Contributors
  • 4 Replies
  • 948 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by rpv_sen

Dani AI

Generated

As already spotted, the immediate reason nothing showed up was the wrong variable in the fetch loop: the prepared statement was executed in one variable but you tried to fetch from another. Fixing that gets you past the silent failure. Beyond that, here are a few practical improvements to make the search safe and reliable.

Trim and split the input with preg_split, remove empty tokens, and cap the number of terms to avoid huge queries. Build the WHERE clause with dynamic placeholders (one per term) and bind each value with the % wildcards — that prevents SQL injection while still allowing LIKE matching. Always set PDO to throw exceptions and escape output with htmlspecialchars when printing titles to avoid XSS.

<?php
$pdo = dbConnect();
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$raw = isset($_GET['search']) ? trim($_GET['search']) : '';
if ($raw === '') { exit; }

$terms = array_slice(array_filter(preg_split('/\s+/', $raw)), 0, 8);

$clauses = $params = [];
foreach ($terms as $i => $t) {
  $ph = ":t{$i}";
  $clauses[] = "title LIKE $ph";
  $params[$ph] = "%{$t}%";
}

$sql = 'SELECT manuscript_id, title FROM manuscript WHERE ' . implode(' OR ', $clauses) . ' LIMIT 100';
$stmt = $pdo->prepare($sql);
foreach ($params as $k => $v) { $stmt->bindValue($k, $v, PDO::PARAM_STR); }
$stmt->execute();

foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $row) {
  echo htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8') . "<br>\n";
}

If you expect larger datasets or need relevance, consider MySQL full-text indexes (MATCH ... AGAINST) and add pagination. Wrapping search logic into a small class or method, as suggested, keeps it testable and reusable.

Recommended Answers

All 4 Replies

Member Avatar for rpv_sen

Hi can you replace $sql to $query in line 39

while ($row = $sql->fetch())

into

while ($row = $query->fetch())
Member Avatar for rubberman

PHP is an object-oriented langauge. Use it that way! See my tutorial post about that. It will make your life much simpler, with a little forethought and setup.

Member Avatar for Amaina

Thank you very much Palanivelu Rajagopal. I cannot believe i looked at this code a thousand times but could not see the annomaly.....

Member Avatar for rpv_sen

thanks Amaina

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.