I'm trying to execute this query:
Query 1:
$query = "SELECT a.*, b.title_wo
FROM `worksheet_master` AS a
INNER JOIN `work_order` AS b ON a.wo_number = b.wo_number
WHERE CONCAT (a.`wo_number` like '" . $_POST["keyword"] . "%',
`title_wo` like '" . $_POST["keyword"] . "%')
ORDER BY a.`wo_number` DESC LIMIT 0,50";
Query 2:
$query = "SELECT a.*, b.title_wo
FROM `worksheet_master` AS a
INNER JOIN `work_order` AS b ON a.wo_number = b.wo_number
WHERE CONCAT (a.`wo_number` like '" . $_POST["keyword"] . "%',
`title_wo` like '" . $_POST["keyword"] . "%')
AND a.`status` = 'NULL'
ORDER BY a.`wo_number` DESC
LIMIT 0,50";
The Query 2 didn't gave me any result with AND clause while the Query 1 gave me the result.
Can anyone help me with this? I need to sort out the result which has the empty status in my table, that's why I added AND clause in Query 2 hoping the result will be as expected, but it's not.
Thank You.
CONCAT()
arguments is highly non-intuitive. – Gordon Linoff Dec 8 '16 at 19:14$_GET
data is used inside the query. Whenever possible use prepared statements. These are quite straightforward to do inmysqli
and PDO where any user-supplied data is specified with a?
or:name
indicator that’s later populated usingbind_param
orexecute
depending on which one you’re using. NEVER put$_POST
or$_GET
data directly in your query. – tadman Dec 8 '16 at 19:16