1

I have implemented custom search to get some values from node.

When I'm using special chars like "/, ?, !", no result is being displayed.

Example value : "24/7" or "site?" or "test!", etc...

$search_text = '24/7';
$query->condition(db_or()
->condition('n.title', '%' . db_like($search_text) . '%', 'LIKE')
->condition('fld.body_value', '%' . db_like($search_text) . '%', 'LIKE'));

I'm running my site in Drupal 7. PHP version is 5.5.9. Using Mysql DB. OS windows.

Note: Query is correct. Its giving proper result for other than special chars.

Edit: $query->arguments(); is returning below image. enter image description here

I was running LIKE command in phpmyadmin. Please find that screen shot below.

enter image description here

So what is the modification do we need to do at PDO to support this issue?

3
  • And what db_like($search_text) actually returns? See here - that's how you can extract both rendered query, and placeholders. Do it, edit it into your question, and we might be able to help.
    – Mołot
    Commented Sep 8, 2014 at 14:58
  • I just checked - db_like is nothing more than sophisticated wrapper around addcslashes with simple parameters: addcslashes($string, '\%_'). It shouldn't affect your strings in any way, if it does, we will also need your PHP version and database driver you use with your Drupal. and the data I already requested, of course.
    – Mołot
    Commented Sep 8, 2014 at 15:21
  • Those chars aren't special, they're just as ascii as every other char you're using db_like('24/7') returns the string 24/7 (as you'd expect), so your problem is somewhere else. Cast the $query object to a string and see what the SQL is like. That should show you where the problem is
    – Clive
    Commented Sep 8, 2014 at 15:36

1 Answer 1

2

It doesn't look like anything wrong with query. I'm using drupal 7 with basic setup and one node(nid=3) has 24/7 in title & body and one node(nid=4) has only in body.

  // Make sure to decode, if the search string is part of URL.
  // $search_text = urldecode($_GET['query']);

  $search_text = '24/7';
  $query = db_select('node', 'n');
  $query->join('field_data_body', 'b', 'b.entity_id=n.nid');
  $query->fields('n', array('nid'))
    ->condition(db_or()
    ->condition('n.title', '%' . db_like($search_text) . '%', 'LIKE')
    ->condition('b.body_value', '%' . db_like($search_text) . '%', 'LIKE')
  );
  $result = $query->execute()->fetchAll();
  print_r(db_like($search_text));
  print_r($query->arguments());
  print_r($result);

and the result is:

// print_r(db_like($search_text));
24/7

// print_r($query->arguments());
Array
(
    [:db_condition_placeholder_0] => %24/7%
    [:db_condition_placeholder_1] => %24/7%
)

// print_r($result);
Array
(
    [0] => stdClass Object
        (
            [nid] => 2
        )

    [1] => stdClass Object
        (
            [nid] => 3
        )

)

Note: If you are getting the search string from URL as query string make sure, you have done urldecode() before send to SQL.

4
  • Thanks vijay for your answer. I'm getting this value from url. Ex: url?text=24/7. Here how can I sanitize my input (Text)? If we do sanitization, it should work with db_like.
    – Kalidasan
    Commented Sep 10, 2014 at 5:14
  • Updated the note with URL specific details.
    – vijaycs85
    Commented Sep 10, 2014 at 15:07
  • hey @vijaycs85, good to see you on Drupal Answers!
    – AjitS
    Commented Sep 10, 2014 at 15:25
  • @vijay: dsm(urldecode("24/7 <script> alert('hi') </script>")); It should not sanitize input.
    – Kalidasan
    Commented Sep 11, 2014 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.