I have implemented custom search to get some values from node.

When I'm using special chars like "/, ?, !", no result is being displayed.

Example value : "24/7" or "site?" or "test!", etc...

$search_text = '24/7';
->condition('n.title', '%' . db_like($search_text) . '%', 'LIKE')
->condition('fld.body_value', '%' . db_like($search_text) . '%', 'LIKE'));

I'm running my site in Drupal 7. PHP version is 5.5.9. Using Mysql DB. OS windows.

Note: Query is correct. Its giving proper result for other than special chars.

Edit: $query->arguments(); is returning below image. enter image description here

I was running LIKE command in phpmyadmin. Please find that screen shot below.

enter image description here

So what is the modification do we need to do at PDO to support this issue?

  • And what db_like($search_text) actually returns? See here - that's how you can extract both rendered query, and placeholders. Do it, edit it into your question, and we might be able to help. – Mołot Sep 8 '14 at 14:58
  • I just checked - db_like is nothing more than sophisticated wrapper around addcslashes with simple parameters: addcslashes($string, '\%_'). It shouldn't affect your strings in any way, if it does, we will also need your PHP version and database driver you use with your Drupal. and the data I already requested, of course. – Mołot Sep 8 '14 at 15:21
  • Those chars aren't special, they're just as ascii as every other char you're using db_like('24/7') returns the string 24/7 (as you'd expect), so your problem is somewhere else. Cast the $query object to a string and see what the SQL is like. That should show you where the problem is – Clive Sep 8 '14 at 15:36

It doesn't look like anything wrong with query. I'm using drupal 7 with basic setup and one node(nid=3) has 24/7 in title & body and one node(nid=4) has only in body.

  // Make sure to decode, if the search string is part of URL.
  // $search_text = urldecode($_GET['query']);

  $search_text = '24/7';
  $query = db_select('node', 'n');
  $query->join('field_data_body', 'b', 'b.entity_id=n.nid');
  $query->fields('n', array('nid'))
    ->condition('n.title', '%' . db_like($search_text) . '%', 'LIKE')
    ->condition('b.body_value', '%' . db_like($search_text) . '%', 'LIKE')
  $result = $query->execute()->fetchAll();

and the result is:

// print_r(db_like($search_text));

// print_r($query->arguments());
    [:db_condition_placeholder_0] => %24/7%
    [:db_condition_placeholder_1] => %24/7%

// print_r($result);
    [0] => stdClass Object
            [nid] => 2

    [1] => stdClass Object
            [nid] => 3


Note: If you are getting the search string from URL as query string make sure, you have done urldecode() before send to SQL.

| improve this answer | |
  • Thanks vijay for your answer. I'm getting this value from url. Ex: url?text=24/7. Here how can I sanitize my input (Text)? If we do sanitization, it should work with db_like. – kalidasan Sep 10 '14 at 5:14
  • Updated the note with URL specific details. – vijaycs85 Sep 10 '14 at 15:07
  • hey @vijaycs85, good to see you on Drupal Answers! – AjitS Sep 10 '14 at 15:25
  • @vijay: dsm(urldecode("24/7 <script> alert('hi') </script>")); It should not sanitize input. – kalidasan Sep 11 '14 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.