Another question regarding search engine code

Hello all,
This is part of my code, if this looks familiar, it's taken from devshed.com:


1. I'm getting this error
"Warning: Supplied argument is not a valid MySQL result resource in /home/omis107/main.php on line 45"
I believe line 45 is "$resultsnumber = mysql_numrows($getresults);"

Can anyone tell me what the problem might be?

2. And in this line
$getresults = mysql_query("SELECT * FROM Music_Library LIKE '%$search%'");
What code should I write for $search if I want to perform a search of a string taken from the search engine text box?

3. And if you would look at this webpage , notice the alphabets at the top of the page. I'm hoping that if let's say I click on "A", it would bring up a list of data from my music_library table that starts with "A". How should I do that? Is there any reference that you can link me to?

For the first question, try putting the following code just below:

$resultsnumber = mysql_numrows($getresults);




That'll output any error message from MySQL.


For question 2, do you mean how do you collect the contents of the search text box? If so, just with:

$search = '';
$search = $_POST['searchquery'];

First line makes sure the variable $search isn't tainted and second one collects the posted data from the form. "Searchquery" is the name of the form text box.

I would however recommend doing some checks on what they submit with commands like strip_tags() and escapeshellcmd() before sending it to the dbase. More info about those on http://www.php.net


For question 3:

I'm guessing on that page there should be links to the letters (unless it doesn't work on IE5.5). I'd guess you could link to each letter like:

searchscript.php?searchquery=a
searchscript.php?searchquery=b
etc..

Then you'd collect the data from the GET

$search = '';
$search = $_GET['searchquery'];

...and then in the SQL statement use something like:

LIKE '%$search'

...which if I remember means find anything beginning with $search, eg: a, b etc.


Another tip if you're having problems with SQL statements is to echo the SQL statement just to make sure there aren't any typos in there or problems with missing or invalid data.

Trev
--
http://www.aardvarktravel.net/

I thought it was mysql_num_rows(), not numrows()? (Note the underscore). Maybe both work. But I believe you have an error in your SQL statement.
SELECT * FROM Music_Library LIKE '%$search%' is wrong.
Try SELECT * FROM Music_Library WHERE field LIKE '%$search%' instead. "Field" is the table column in which you want to search. It could be a variable, if you want the user to choose to search in either artist name, album title, etc.



You should pass the letter as a parameter to your page (like "list.php?letter=A", "list.php?letter=B", etc.), and the SQL would be something like "WHERE field = '$letter%'.

trevHCS gave some good advice, but he's wrong on one point, the wildcard (%) goes AFTER ($letter%, not %$letter) if you want to search for results that start with the letter (%$letter will find results that END with $letter). For an example, check out the link in my site, and go to "Browse bands by letter".

Opps - good point! Should have checked some original code really before posting.

Trev