Avatar of PeterdeB
PeterdeB
Flag for Netherlands asked on

How to exclude %%% from search results

Hi

I need to secure this script, it works as planned but returns results if one enters '%%%', I thought htmlentities would fix that but that is not the case, and htmlspecialchars does not fix it either, or it is in the wrong order?
function search_results($keywords) {
$returned_results = array();
$where = "";
$keywords = preg_split('/[\s]+/', $keywords);
$total_keywords = count($keywords);
foreach($keywords as $key=>$keyword) {
$where .= "`keywords` LIKE '%$keyword%'";
if ($key != ($total_keywords - 1)) {
$where .= " OR ";
}
}
$results = "SELECT `title`, LEFT(`description`, 70) as `description`, `url` FROM `articles` WHERE $where";
$results_num = ($results = mysql_query($results)) ? mysql_num_rows($results): 0;
if ($results_num === 0) {
return false;
} else {
while ($results_row = mysql_fetch_assoc($results)) {
$returned_results[] = array(
'title' => $results_row['title'],
'description' => $results_row['description'],
'url' => $results_row['url']
);
}
return $returned_results;
}
}

Open in new window

PHP

Avatar of undefined
Last Comment
PeterdeB

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Rik-Legger

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Derokorian

I think you are looking to add: AND NOT LIKE '%\%%'
http://dev.mysql.com/doc/refman/5.0/en/string-comparison-functions.html

HTH
PeterdeB

ASKER
Thanks for your fast and great help
PeterdeB

ASKER
@Derokorian: also thanks for your help, but the first answer solved it right away
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck