使用PHP pdo的简单Mysql DB搜索-返回不正确的值

Question

I am developing a very basic php/mysql search. The search is based on a filter criteria of the value chosen from a dropdown menu. For this example I limited the filter to search all tables only. The tables are blog and pages . I have been able to get a fully functional search using php mysqli style but I am running until a wall when using PDO style.. For the search using mysqli , a mysqli_query is executed and followed by mysqli_num_rows to count the number of rows of the results. The main problem is the following:

The approach is a little different for the PDO style as I can't use rowCount . I have to use fetchColumn in this manner shown HERE . The results for the PDO sytle search are incorrect and not displaying properly? Test both searches with keyword blah . The correct search will display 13 results.

SEARCH-1 -Mysqli style

SEARCH-2 -PDOstyle

mysqli

include("db_con/db_con.php");
$search_output = "";
if(isset($_POST['searchquery']) && $_POST['searchquery'] != ""){
  $searchquery = preg_replace('#[^a-z 0-9?!]#i', '', $_POST['searchquery']);
  if($_POST['filter1'] == "All Tables"){
    $sqlCommand = "(SELECT id, page_title AS title FROM pages WHERE page_title LIKE '%$searchquery%' OR page_body LIKE '%$searchquery%') UNION (SELECT id, blog_title AS title FROM blog WHERE blog_title LIKE '%$searchquery%' OR blog_body LIKE '%$searchquery%')";
  }
  $query = mysqli_query($db_conx, $sqlCommand) or die(mysql_error());
  $count = mysqli_num_rows($query);
  if($count > 0){
    $search_output .= "<hr />$count results for <strong>$searchquery</strong><hr />$sqlCommand<hr />";
    while($row = mysqli_fetch_array($query)){
              $id = $row["id"];
        $title = $row["title"];
        $search_output .= "Item ID: $id - $title<br />";
                } // close while
  } else {
    $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />$sqlCommand";
  }
}

pdo

include("db_con/db_con.php");
$search_output = "";
if(isset($_POST['searchquery']) && $_POST['searchquery'] != ""){
  $searchquery = preg_replace('#[^a-z 0-9?!]#i', '', $_POST['searchquery']);
  if($_POST['filter1'] == "All Tables"){
   $sqlCommand = "(SELECT COUNT(*) FROM pages WHERE page_title LIKE '%$searchquery%' OR page_body LIKE '%$searchquery%') UNION (SELECT COUNT(*) FROM blog WHERE blog_title LIKE '%$searchquery%' OR blog_body LIKE '%$searchquery%')";
    $sql_prepare = $db_con->prepare($sqlCommand);
  }
  if($sql_prepare->execute()){
    $count = $sql_prepare->fetchColumn();
    if($count > 1){
      if(isset($_POST['searchquery']) && $_POST['searchquery'] != ""){
        $searchquery = preg_replace('#[^a-z 0-9?!]#i', '', $_POST['searchquery']);
        if($_POST['filter1'] == "Whole Site"){
         $sqlCommand = "(SELECT id, page_title AS title FROM pages WHERE page_title LIKE '%$searchquery%' OR page_body LIKE '%$searchquery%') UNION (SELECT  id, blog_title AS title FROM blog WHERE blog_title LIKE '%$searchquery%' OR blog_body LIKE '%$searchquery%')";
          $sql_prepare = $db_con->prepare($sqlCommand);
        }
      }
      $search_output .= "<hr />$count results for <strong>$searchquery</strong><hr />$sqlCommand<hr />";
      $query = $sql_prepare->fetchAll();
      foreach($query as $row){
          $id = $row["id"];
          $title = $row["title"];
          $search_output .= "Item ID: $id - $title<br />";
          } // close while
    } else {
      $search_output = "<hr />0 results for <strong>$searchquery</strong><hr />$sqlCommand";
    }
  }
}

html

<form method="POST" action="<?php echo $_SERVER['PHP_SELF'] ?>">
Search For:
  <input name="searchquery" type="text" size="44" maxlength="88">
Within:
<select name="filter1">
<option value="All Tables">All Tables</option>
</select>
<input name="myBtn" type="submit">
<br />
</form>

Answer 1

Edit to include more complete form.

The only thing that is different from your mysqli solution is how you count the number of items in the result set.

include("db_con/db_con.php");
$search_output = "";
if(isset($_POST['searchquery']) && $_POST['searchquery'] != ""){
  $searchquery = preg_replace('#[^a-z 0-9?!]#i', '', $_POST['searchquery']);
  if($_POST['filter1'] == "All Tables"){
    $sqlCommand = "(SELECT id, page_title AS title FROM pages WHERE page_title LIKE '%$searchquery%' OR page_body LIKE '%$searchquery%') UNION (SELECT id, blog_title AS title FROM blog WHERE blog_title LIKE '%$searchquery%' OR blog_body LIKE '%$searchquery%')";
  }
  $sql_result = $db_con->query($sqlCommand);
  $query = $sql_prepare->fetchAll();
  $count = count($query);
  $search_output="";
  foreach($query as $row){
    $id = $row["id"];
    $title = $row["title"];
    $search_output .= "Item ID: $id - $title<br />";
  } 
  echo $search_output;
}

When you are not using prepared statement, there is no need to do PDO::prepare. However it is a good practice to use prepared statement whether in mysqli or PDO..