Division by zero, "Query was empty" error in MySQL - php

Question

I try to make a search engine for profiles, but I stock with an error that "Division by zero" and and after I used var_dump(mysql_error()) it shows me "Query was Empty".
here is my query and php code:
$search_rs = dbq('SELECT * FROM users WHERE fname LIKE '%$_GET[query]%' LIMIT 0, OR fname LIKE '%$_GET[query]%'');
if($search_rs == false) {
var_dump(mysql_error());
}
elseif (db_num($search_rs) > 0) {
while ($results = db_next($search_rs)) {
echo('<li>
<a class="avatar" href="http://mysite/'.$results['pagekey'].'" target="_blank">
<img src="'.thumbnail($results['avatar'], 64, 64).'" />
</a>
<div class="info">
<a href="http://profiler.ir/'.$results['pagekey'].'" target="_blank">
<span class="fullname">'.$results['pre_name'].' '.$results['fname'].' '.$results['lname'].'</span>
</a>
</div>
</li> ');
}
}
else echo "not found !!!";
BUT When I remove LIKE '%$_GET[query]%'and make a simple query without LIKE , it return results.

Answer 1

Change your query from this:
'SELECT * FROM users WHERE fname LIKE '%$_GET[query]%' LIMIT 0, OR fname LIKE '%$_GET[query]%''
To this:
"SELECT * FROM users WHERE fname LIKE '%" . $_GET['query'] . "%'"
The issues you had were:
Using single quotes for the whole query string as well as the LIKE '%…%' values inside of them. So using double quotes now, concatenating the values.
You also had missing single quotes for your $_GET[query] so those are changed to $_GET['query'].
The placement of LIMIT 0, makes no sense so that is gone.
Also unsure why you had two fname LIKE '%" . $_GET['query'] . "%' in there. Removed the second one.
If you somehow need the LIMIT then this query should work:
"SELECT * FROM users WHERE fname LIKE '%" . $_GET['query'] . "%' LIMIT 0,100"
But I am just presuming you need 100 items, so change that 100 as well as the 0 offset to best match your needs.

Answer 2

The MySQL error is caused by malformed SQL text. The problem in the code is that the desired SQL text isn't being produced, due to the PHP syntax for interpreting/concatenating strings.
I recommend you use double quotes around the literal portions of the string, and use a dot operator to signify concatenation.
I also recommend you do the string manipulation as a separate step, so that the SQL text is available for inspection/debugging.
I also strongly recommend you use the mysql_real_escape_string function to reduce SQL injection vulnerabilities (when including user supplied data within the SQL text).
As an example:
$sql = "SELECT * FROM users WHERE fname LIKE '%" . mysql_real_escape_string($_GET[query]) . "%'";
#vardump($sql); # for inspecting/debugging issues with generating SQL text
$search_rs = dbq($sql);
Little Bobby Tables XKCD Exploits of a Mom