Help with getting Search Form to search within

PHP
1

Thanks for all the previous help.
The web video script that I’m modifying successfully filters videos into categories and subcategories. I’ve added this Search Form which appears on subcategory html results pages:

<?php
if (preg_match('#/?sub__(\d)+\b#',$_SERVER['REQUEST_URI'],$matches)) {
echo "<form action='#' method='GET' id='subcategory'>
<input id='search' name='keywords' type='text' placeholder='Search--SubCategory'> <input type='submit' value='Search' />
<input type='hidden' id='subcategory' name='sub_category_id' value='{$matches[1]}'>
</form>";
}
?>

I’ve also added the following code to the same page in an attempt to get the Search Form to have the functionality of searching just within the currently displayed subcategory page(s) results, for title, description and/or tags(keywords), and display those results:

<?php
if (!empty($_POST['search_value'])) {
$search_value = PT_Secure($_POST['subcategory']);
$search_result = $db->rawQuery("SELECT * FROM " . T_VIDEOS . " WHERE title  '%$search_value%' OR tags '%$search_value%' OR description '%$search_value%') AND sub_category = '%$search_value%' ");

");
if (!empty($search_result)) {
$html = '';
foreach ($search_result as $key => $search) {
$search = PT_GetVideoByID($search, 0, 0, 0);
$html .= "
<div class='search-result'><a href='$search->url'>$search->sub_category</a></div>";
}
$data = array('status' => 200, 'html' => $html);
}
}
?>

but no success yet. The T_VIDEOS (videos table) looks like this (attached).
Any guidance with this is appreciated

VidTable
VidTable798×811 99.3 KB

2

need more WHERE.
(Literally. You need to tell it to only search where the category matches your current subcategory.)
WHERE (title LIKE '%$search_value%' OR tags LIKE '%$search_value%' OR description LIKE '%$search_value%') AND sub_category = whatevervalueyousentwiththeform

You’re going to have several people come along and tell you that this is a dangerous query. Because it is. You’re not sanitizing the values you’re putting into your database query.

What if I sent the following string into your search bar?
'; TRUNCATE TABLE videos; SELECT * FROM videos WHERE title LIKE '

5

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.