为什么SQL查询返回0？ 什么是实际查询？

Question

require 'connect_db.php';
require 'User.php';
$stmnt = $con->prepare("select f_name, l_name from user where f_name LIKE :q OR l_name LIKE :q OR dept LIKE :q OR batch LIKE :q OR email LIKE :q");
$q = $_GET['q'];
$q1 = "'%".$q."%'";
$stmnt->bindParam(':q',$q1);
$stmnt->execute();
$results = $stmnt->fetchAll(PDO::FETCH_OBJ);
echo count($results);

When I am writing it mysql command line it is returning 1 row but this code is not.. please help me to correct it.

My sql query is :select f_name, l_name from user where f_name LIKE '%s%' or l_name LIKE '%s';

this is returning 1 row.

Answer 1

When you use parameters they will be sent as is and escaped when needed. You write

$q1 = "'%".$q."%'";

This means that the string in the end will be '%something%' and this will be escaped into the SQL query. You most likely don't want to find strings beginning and ending with ' so remove them to get %something%.

$q1 = "%".$q."%";