Can't add LIKE to my SQL query

Question

include("config.php");
$page_number = filter_var($_POST["page"], FILTER_SANITIZE_NUMBER_INT, FILTER_FLAG_STRIP_HIGH);

if(!is_numeric($page_number)){
  header('HTTP/1.1 500 Invalid page number!');
  exit();
}
session_start();
$position = (($page_number-1) * $item_per_page);

if(!empty($_SESSION['type'])){
  $typesql = $_SESSION['type'];
  $results = $mysqli->prepare("SELECT name, location, score, img, id, type FROM artists WHERE type = ? ORDER BY score DESC LIMIT ?, ?");
  $results->bind_param("sii", $typesql, $position, $item_per_page);
  $results->execute();
  $results->bind_result($name, $location, $score, $img, $id, $type);
} else {
  $results = $mysqli->prepare("SELECT name, location, score, img, id, type FROM artists ORDER BY score DESC LIMIT ?, ?");
  $results->bind_param("ii", $position, $item_per_page);
  $results->execute();
  $results->bind_result($name, $location, $score, $img, $id, $type);
}

// Le fetch
  while($results->fetch()){
    //my cards here
  }
  ?>

I'm looking for ultimately hooking my search box to this query which is not working, I've tried to add alter the query to the below for testing purpose:

SELECT name, location, score, img, id, type FROM artists WHERE name LIKE '%etc%' ORDER BY score DESC LIMIT ?, ?

and I do have a name that has "etc" in it but the result I get is:

Call to a member function bind_param() on boolean in

How do I change this query to bind the $_GET result from the searchbox to it, the website is Setch.me

You have a typo: LIKE '%etc% ORDER BY you're missing a ' after your comparison string — Ryan Tuosto, Jun 26 '17 at 17:19
Note, if you encounter a non-numeric page number, you should exit with a 400 status, not 500. Remember, 4xx is "you screwed up" and 5xx is "I screwed up." — Alex Howansky, Jun 26 '17 at 17:20

score 2 · Accepted Answer · answered Jun 26 '17 at 17:23

2

As in this question you can use LIKE with a bound parameter in mysqli:

$param = "%{$_POST['searchphrase']}%";
$stmt = $mysqli->prepare("SELECT name, location, score, img, id, type FROM artists WHERE name LIKE ?");
$stmt->bind_param("s", $param);
$stmt->execute();
$stmt->bind_result($name, $location, $score, $img, $id, $type);

answered Jun 26 '17 at 17:23

WEBjuju

5,797
4
27
36

1

adding the % in the param is awesome, thanks man that worked. – Kareem Kamal Jun 26 '17 at 17:32

Can't add LIKE to my SQL query

1 Answers1