0

I have the following query:

$results=$facilities=$mydb->get_results("SELECT facility_name from facility where  facility_name like '%".$facility_name."%' LIMIT 0, 10");

It is not working regardless of whatever is typed as the facility name. It is just returning top 10.

0

You should definitely be using prepare in this case, as your query is accepting input. It would be quite trivial for someone to compromise your database otherwise. Here we also use the new-in-4.0 esc_like method:

$like = '%' . $mydb->esc_like( $facility_name ) . '%';
$results = $mydb->get_results(
    $mydb->prepare(
        "SELECT facility_name FROM facility WHERE facility_name LIKE %s LIMIT 0, 10",
        $like
    )
);
| improve this answer | |
  • I have made the said changes but still, the query is not working as expected. it is selecting everything. This is the code where the function with the query is called. jQuery('#facility_name').keyup(function() { $('#key').html(""); cid=jQuery(this).attr('val'); var ajaxurl="<?php echo admin_url( 'admin-ajax.php' ); ?>"; var data ={ action: "department_action", facility_name:cid }; $.post(ajaxurl, data, function (response){ $('#key').html(response); }); }); – Wilson Dec 30 '14 at 17:58
  • edit your question and add the full context of your code. if you're getting back everything, I'll guess that $facility_name is not what you expect it is, you're searching for an empty string, so it's matching everything. – Milo Dec 30 '14 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.