Count all products with search function - php

Question

I’ve been trying to call a function and it just doesn’t seem to work.
So, this is function count_all_products_q. This is needed for pagination.
function count_all_products_q($options=[]) {
global $db;
$visible = $options['visible'] ?? false;
$search_statement = isset($_POST['search']) ? $_POST['search'] : '';
if ($search_statement == '') {
$search_statement = isset($_GET['search']) ? $_GET['search'] : '';
}
$search = h(db_escape($db, $search_statement));
$sql = "SELECT COUNT(id) FROM products ";
if ($search != '') {
$search = h(db_escape($db, $search_statement));
$sql .= "WHERE (`prod_name` LIKE '%".$search."%') ";
}
if($visible) {
$sql .= "AND visible = true ";
}
$sql .= "ORDER BY position ASC";
$result = mysqli_query($db, $sql);
confirm_result_set($result);
$row = mysqli_fetch_row($result);
mysqli_free_result($result);
//[0] - I want only one number.
$count = $row[0];
return $count;
}
search.php
$products_count = count_all_products_q(['visible' => $visible]);
//if count is nothing ('') redirect to....
if($products_count == '') {
redirect_to(url_for('/index.php'));
}
This part doesn’t work if($products_count == '') when I click search by mistake, instead of redirection, I have Database query failed (search.php?search=).
Am I missing something, did I do something wrong? Thanks for your attention!
UPDATE2 everything works!
search.php
$visible = $visible ?? true;
$search_statement = isset($_POST['search']) ? $_POST['search'] : '';
if ($search_statement == '') {
$search_statement = isset($_GET['search']) ? $_GET['search'] : '';
}
$search = h(db_escape($db, $search_statement));
if($search == '') {
redirect_to(url_for('/index.php'));
}
$products_count = count_all_products_q(['visible' => $visible]);

Answer 1

You have problem with the code where you are concatenating "WHERE" condition.
if($visible) then "WHERE" which is wrong and will give query error if this condition fails. Also $options['visible'] ?? false; this code may cause issue depending on the version on PHP. You can change your conditions like this to make it work in all scenarios.Followed by rest of the logic.
$sql = "SELECT COUNT(id) FROM products WHERE 1 ";
if($visible) {
$sql .= "AND visible = true ";
}
if ($search != '') {
$search = h(db_escape($db, $search_statement));
$sql .= "AND (prod_name LIKE '%".$search."%') ";
}

Answer 2

In case there is no visible is false ans search has text your query will be broken
In this case you should
if($visible) {
$sql .= "WHERE visible = true ";
}
if ($search != '') {
$search = h(db_escape($db, $search_statement));
$sql .= $visible ? 'AND ' : 'WHERE';
$sql .= " (`prod_name` LIKE '%".$search."%') ";
}
Not tested but I hope you can see your problem.

Answer 3

Print your query with echo $sql or with echo $this->db->query()
Run directly in mysql and check why it is getting failed.
May you have generate wrong query.