使用“％”从SQL查询中获得奇怪的结果

Question

I tried to get results from my database using SQL but my results do not agree with what i am using as input. I always gets results from those who contains both integers and characters. For example, if i search for "liu" i get a result of "2LK020". I neither cant search with integers and get a correct result... I use:

    $result = queryDatabase(
    "SELECT course_tag, course_name FROM course WHERE course_tag OR course_name LIKE ?",
    array(1 => '%' .$parameters[0]. '%')

is there a problem using "%"? or why do i get this weird answers?

Answer 1

Read this: http://dev.mysql.com/doc/refman/5.7/en/operator-precedence.html

You're doing the equivalent of

WHERE course_tag OR (course_name LIKE ?)

which comes to

WHERE true/false OR true/false

As long as course_tag isn't an empty string or a null or other "falsey" value, it'll pretty much always evaluate to a true value, and make the entire WHERE clause evaluate to true .

You can't test multiple fields against a single LIKE value. That simply doesn't work. You need to test each one individually:

WHERE (course_tag LIKE ?) OR (course_name LIKE ?)

However, since you're doing a %...% double-wild card search, you could optimize a bit with

WHERE CONCAT(course_tag, course_name) LIKE ?