not sure...

[etsted]

i want "tittel LIKE '%$search%' OR" to be a part of the $sql statement if the $type variable of the "which_type" function is not equal to register. The error i get when i try to run this script is:

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') { tittel LIKE '%g%' OR } ' at line 2

 

So im guessing that it is not recieving the input from the $search variable, but i dont know why.

 

 

$sqlCommand = "";

 

$type = $_GET['type']; // stores the selected type, from a select drop down box

$search = $_GET['s']; // stores the input, the user has typed in // this contains the information the user has typed in $search = trim($_GET['s']); $search = mysqli_real_escape_string($con, $search); // this is the table the user wishes to do a search in $type = preg_replace("%[^a-z0-9]%i", "", $_GET['type']); if(!preg_match("%(images|mp3|videos|register)%", $type)) { echo "something went wrong"; exit; } // searches for a macht in the DB, with what the user typed in function which_type($type, $search){ $sqlCommand = "SELECT * FROM $type WHERE if($type != 'register') { tittel LIKE '%$search%' OR } description LIKE '%$search%' OR username LIKE '%$search%'"; return $sqlCommand; } $sqlCommand = which_type($type, $search); $query = mysqli_query($con, $sqlCommand) or die(mysqli_error($con));

[justsomeguy]

That can't be your actual code, that function has several syntax errors that wouldn't even allow the code to execute at all.Print out the finished SQL statement so that you can see what you are sending to the server.

[justsomeguy]

My mistake, there's not a syntax error, but this is your SQL statement:

SELECT * FROM $type WHEREif($type != 'register'){tittel LIKE '%$search%' OR}description LIKE '%$search%' OR username LIKE '%$search%'

You have PHP code right in the middle of your SQL code. That doesn't work.