Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.

I have a search engine with an html form that sends data to a PHP script the queries a MySQL database. In the html form, I have a option that allows multiple selections. Thus far, I have put square brackets after the name in the HTML in order to make it an array. But I think there is a problem in the PHP because results are not correct.

HTML

<select multiple="multiple" name='category[]'>
      <option>Literature</option>
      <option>History</option>
      <option>Science</option>
      <option>Fine Arts</option>
      <option>Trash</option>
      <option>Mythology</option>
      <option>Phylosophy</option>
      <option>Social Science</option>
      <option>Religion</option>
      <option>Geography</option>
  </select>

search.php

$button = $_GET ['submit'];
$search = $_GET ['search'];

}

if(strlen($search)<=1)
echo "Search term too short";
else{
echo "You searched for <b><em>$search</em></b> and ";
mysql_connect("fake","fake","fake");
mysql_select_db("quinterestdb");}

mysql_real_escape_string($search);

$search_exploded = explode (" ", $search);

foreach($search_exploded as $search_each)
{
$x++;
if($x==1)
$construct .="Answer LIKE '%$search_each%'";
else
$construct .="AND Answer LIKE '%$search_each%'";

}

$cat = $_GET ['category'];
$comma_separated = implode("','", $cat);

$constructs ="SELECT * FROM tossups WHERE $construct AND Category IN('$comma_separated')";
$run = mysql_query($constructs);

When I use the search engine, the script runs just fine, but there are still results that have categories that were not selected. Any idea?

share|improve this question
    
What is the form method? Are you using POST or GET? –  Khawer Zeshan Jun 17 '13 at 6:34
2  
can you print $constructs and run in phpmyadmin. –  Rajeev Ranjan Jun 17 '13 at 6:35
    
GET is default. You don't have to specify. –  PAM Jun 17 '13 at 6:35
1  
What is in the $construct variable? –  Chris Jun 17 '13 at 6:36
2  
option tag should have value attribute assigned, in implode double-quotes are extra, your script is vulnerable to sql injection, you use deprecated mysql API. –  Leri Jun 17 '13 at 6:40
show 9 more comments

1 Answer

That's not the way. Should be something like this, with VALUE

<select multiple="multiple" name='category[]'>
      <option value="v1">Literature</option>
      <option value="v2">History</option>
...
  </select>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.