How to stop search returning all results? - php

Question

I have a search field on my site that searches the database I use.
When I click on the search field and enter no text the search returns all results.
How can I have it so no results are returned if nothing is entered?
Is there any javascript that can help me?
Thanks!
James
<?php
$conn = mysql_connect("---", "", "");
if (!$conn) {
echo "Unable to connect to DB: " . mysql_error();
exit;
}
{
$search = "%" . $_POST["search"] . "%";
$searchterm = "%" . $_POST["searchterm"] . "%";
}
if (!mysql_select_db("weezycouk_641290_db1")) {
echo "Unable to select mydbname: " . mysql_error();
exit;
}
$sql = "SELECT name,lastname,email
FROM test_mysql
WHERE name LIKE '%".$search."%' AND lastname LIKE '%".$searchterm."%'";
$result = mysql_query($sql);
if (!$result) {
echo "Could not successfully run query ($sql) from DB: " . mysql_error();
exit;
}
if(document.getElementById('search').value == '')
return false;
if(document.getElementById('searchterm').value == '')
return false;
if (mysql_num_rows($result) == 0) {
echo "No rows found, nothing to print so am exiting";
exit;
}
while ($row = mysql_fetch_assoc($result)) {
echo '<br>';
echo '<br>';
echo '<div class="data1">';
echo $row["name"];
echo '</div>';
echo '<br>';
echo '<div class="data2">';
echo $row["lastname"];
echo '</div>';
echo '<br>';
echo '<div class="data3">';
echo $row["email"];
echo '</div>';
}
mysql_free_result($result);
?>

Answer 1

Stop right there! SQL injection!
Your code has multiple SQL injection vulnerabilities. Fix them immediately!
Fixed? Let's go on.
Before deciding to perform the search, check if the search term is the empty string. If yes, do not perform the search. For example:
$search = // whatever the user typed; it's a good idea to trim() it
if(empty($search)) {
// return no results
}
else {
// do whatever you normally do
}
You could also perhaps change the search function (more likely, the search SQL query) to return no results if there's nothing to search for, which would basically let you move the above if "deeper inside" your code. IMHO it's best if the if stays here though, so I don't endorse this approach.
Taking care of details with Javascript: If your search is based on a form submission, it might be a good idea to prevent the submission entirely (with Javascript) if the search field is empty as a courtesy to the user. However, you should do this in addition to using the PHP check and not instead of it.
For an example in code, we 'd need to see your HTML.

Answer 2

For very basic control you can do something like that.
if(document.getElementById('searchField').value == '')
return false;

Answer 3

Either you can deny submitting the search form as long as nothing is filled in the search field using Javascript or you block the search in the according php file.
php:
if(empty($_GET['search'])){ // or whatever your field's name is
echo 'no results';
}else{
performSearch(); // do what you're doing right now
}
javascript using jQuery (if you use it):
$('#searchform').submit(function(){ // replace 'searchform' your form's id
return $('#search').val() != ''; // and 'search' with your search field's id
});

Answer 4

I wouldn't do this using JavaScript (as this can be turned off by the user).
I would do it using your server side language when you process the query.
e.g. in PHP something like this would work:
<?php
//processes
if (trim($_GET['search'])=='') {
//dont query anything
} else {
// do your query
}
//output
if (trim($_GET['search'])=='') {
?>
<p>Sorry, your search has returned no results.</p>
<?php
} else {
// output results
}
?>