Need assistance with WHERE rlike and between for search code - php

Question

Hello guys can u point me my mistake :( i want to make multi-column search for my page:
So my script its this:
<?
$search=$_GET['s'];
$query="SELECT * FROM `filmi` WHERE `nomer` rlike '$search' or `rezume` rlike '$search' or `kategoriq` rlike '$search' or ' order by seriq asc ";
?>
want to make to search by price-range so i create this:
<?
$search=$_GET['s'];
$pricemin=$_GET['min'];
$pricemax=$_GET['max'];
$query="SELECT * FROM `filmi` WHERE `nomer` rlike '$search' or `rezume` rlike '$search' or `kategoriq` rlike '$search' or 'seriq' BETWEEN '$pricemin' and '$pricemax' order by seriq asc ";
?>
how to replace between it this case ? i watch some others people code for search engines and they use (SELECT * FROM table WHERE Table1 LIKE '%$table1%' AND Table2 LIKE '%$table2%' AND Price BETWEEN '%$min%','%$max%'");
but its doesnt work with mine ;( pls help

Answer 1

Use BETWEEN to filter your result set by the price range like this
$query="SELECT * FROM `filmi`
WHERE (`nomer` RLIKE '$search' OR
`rezume` RLIKE '$search' OR
`kategoriq` RLIKE '$search') AND
`seriq` BETWEEN '$pricemin' AND '$pricemax'
ORDER BY seriq";
Here is sqlfiddle
And as #cryptic suggested consider using prepared statements either with mysqli_* or PDO.
UPDATE3: And this is how you can use prepared statement in your case with mysqli and make it possible to search by keyword only, by keyword and price range or only by price range:
$stype = 0;
if (isset($_GET['s']) && $_GET['s']){
$search=$_GET['s'];
$stype += 1;
}
if (isset($_GET['min']) && $_GET['min'] &&
isset($_GET['max']) && $_GET['max']){
$pricemin=$_GET['min'];
$pricemax=$_GET['max'];
$stype +=2;
}
if (!$stype) {
echo "Required parameter(s) missing.";
exit;
}
/* connect to the database*/
$db = new mysqli("localhost", "user", "password", "dbname");
/* check connection */
if ($db->connect_errno) {
echo "Connection failed: " . $db->connect_error;
exit();
}
$query="SELECT * FROM `filmi` WHERE ";
if ($stype == 1) {
$query .= " (`nomer` rlike ? OR `rezume` rlike ? OR `kategoriq` rlike ?) ";
} elseif ($stype == 2) {
$query .= " `seriq` BETWEEN ? AND ? ";
} elseif ($stype == 3) {
$query .= " (`nomer` rlike ? OR `rezume` rlike ? OR `kategoriq` rlike ?) AND `seriq` BETWEEN ? AND ?";
}
$query .= " ORDER BY seriq";
/* create a prepared statement */
if (!$stmt = $db->prepare($query)) {
//handle error here;
echo "Error preparing statement.";
exit;
}
/* bind parameters for markers */
if ($stype == 1) {
$stmt->bind_param("sss", $search, $search, $search);
} elseif ($stype == 2) {
$stmt->bind_param("dd", $pricemin, $pricemax);
} elseif ($stype == 3) {
$stmt->bind_param("sssdd", $search, $search, $search, $pricemin, $pricemax);
}
/* execute query */
$stmt->execute();
/* get result */
$result = $stmt->get_result();
if ($result) {
/* now you can fetch the results into an assoc array */
while ($row = $result->fetch_assoc()) {
echo $row['nomer']. ", " .$row['rezume']. ", " .$row['kategoriq']. ", " .$row['seriq']. "<br>";
}
}
/* close statement */
$stmt->close();
/* close db connection */
$db->close();

Answer 2

The query (disregarding SQL injection):
SELECT * FROM table
WHERE field1 LIKE '%$table1%'
AND field2 LIKE '%$table2%'
AND Price BETWEEN 'val3' AND 'val2'
You cannot use BETWEEN to do like comparison.