PHP SQL Remove/ignore spaces, tabs etc from search input - php

Question

I am trying to remove the spaces, whitelines and tabs from the user his input when he searches in the sql database.
So basicly he searches 'Test' (two spaces behind the string) it gives zero results while 'Test' is a correct result in the database. How do I make php / sql use only the word 'Test' as keyword in the sql statement so the result is generated even when the user post spaces before or behind the string. We use a lot of copy and paste when searching so spaces and stuff are in the paste a lot of the time.
I am aware of the questions that are allready here. And I tried all I could implent (as you can see in the overkill tryout..) but none seem to do the trick..
Please help, what am I doing wrong here?
$searchresult = trim(filter_var(isset($_POST['usearch10'])?$_POST['usearch10']:'' , FILTER_SANITIZE_STRING));
$save = trim(filter_var("%{$_POST['usearch10']}%", FILTER_SANITIZE_STRING));
$safedef = trim($save);
$stmt2 = $mysqli->prepare("SELECT * FROM table WHERE `colomn` LIKE trim(?)");
$stmt2->bind_param("s",$safedef);
$stmt2->execute();
$result = $stmt2->get_result();
while ($obj = $result->fetch_assoc()) {

Answer 1

You need to do two things. One is remove the spaces, and trim is enough for that. Unless you're copy-pasting from Microsoft Word, where you could get hidden whitespaces, nonbreaking spaces, and possibly snakes. To get rid of those you might need to use a regular expression (requiring UTF8/mbstring support),
$search = preg_replace('#^\\s*(.*)\\s*$#', '\\1', $search);
I am not sure, but maybe if you copy and paste from HTML you might even encounter a " " instead of a space, so you might want to also use html_entity_decode (after verifying you need it - it can be quite the source of other troubles).
Then you need to specify an inclusion; do that after the filtering, just in case, like this
$search = trim($search);
$search = "%{$search}%"; // search term anywhere
WHERE `column` LIKE ? # You wrote 'colomn' but I assume it was a typo
This simply has to work, but you could also do it this way:
...WHERE `column` LIKE CONCAT('%', ?, '%');
to be sure that MySQL understands what you're trying to tell it.
Try also printing the search term and the query and running it by hand to see what happens. And always check that the query did run successfully. To be even safer, dump the json_encode($search). So, if you forgot a semispace, you'll see not the expected "Test" but something like, if memory serves, "Test\u00a0".
If the absolute worst comes to the worst, activate the session-level "general_log" in MySQL and inspect the actual query MySQL gets sent in the MySQL log_file.

Answer 2

I have never used trim in SQL, but if that is changing something or not, your problem could be that you are not searching like LIKE ”%STRING_TO_SEARCH%". % at the beginning will tell to match anything before it, and the same character at the end will tell to also match anything after your desired string.