I'm remembering why I hate coding...
The syntax on these is wrong, and I don't know how.
Code:
$query = "SELECT * FROM movies WHERE title=$_POST['titlesearch'] ";
Code:
$query = "SELECT * FROM movies WHERE MATCH ( tags ) AGAINST ($tagsearch) ";
'titlesearch' and 'tagsearch' are brought in from an HTML page with some simple forms on it:
Code:
<form action="titlesearch.php" method="post">
<p>Title Search: <input type="text" name="titlesearch" /><input type="submit" /></p>
</form>
<form action="tagsearch.php" method="post">
<p>Tag Search: <input type="text" name="tagsearch" /><input type="submit" /></p>
</form>
I've been googling for hours, but it seems no one bothers to document the really easy stuff.
Start first by issuing a query by hand. Take a known value for "title" and build the query by hand and see if it returns anything. If it does, then move into the php code. For example, lets say you wrote out "SELECT * FROM movies WHERE title='gone with the wind';" and see if anything is returned (obviously replace it with a movie you
know is in the DB.
You may also want to try SELECT * FROM movies WHERE title LIKE '%$keyword%';
You also have to make sure you've added fulltext search capabilities on your table.
Code:
ALTER TABLE movies ADD FULLTEXT(title);
If you have other fields that need fulltext, just comman seperate them in the above statement.
Also, just as an FYI for future projects you may work on that might be more than personal. It's very bad practice to place the value of $POST or $GET into any SQL query directly. For this project you are doing, it isn't a big deal, but if you work on stuff in the future, don't do this.
If you don't know the reason why, it's because of a
SQL Injection type attack that could destroy your database. Rule of thumb, never ever trust the data coming from HTML forms. Always restrict the possibilities in your code. You can also help this by using the php method for addslashes() around the value. This way the string will be taken literal into the database.
Change the code to something like this:
PHP:
$query = "SELECT * FROM movies WHERE title=addslashes($_POST['titlesearch'])";
Another tip you might want is to change the "action" part of your form to use
PHP:
<? echo $_SERVER['PHP_SELF']; ?>
. This will tell PHP to use the form to itself. If you ever rename your file from "tagsearch.php" you won't need to edit the code because PHP will inherit the new name of the file. This assumes that your form posts to itself. If not, don't change your action field.
Another tip when writing your SQL statements, try to avoid using "SELECT *" for them and rather, specify every column you need even if you want all of them. If you use "*" and rely on the order of the returned fields and one day alter your database...you might end up breaking your code. So if you specify the field order every time and get into this habit, you won't break your code down the road. Also, if you don't need all the data, there is no point in selecting it to waste time on the DB engine.
