带字段选择的搜索栏始终返回无记录，求代码问题排查

Hey there, let's figure out why your search keeps returning "No records found"—I've spotted a couple of critical issues in your PHP code that are almost certainly causing this:

1. You're missing the database connection in your query call #

The mysqli_query() function requires the database connection handle ($link) as its first parameter when using the procedural style. Your current code doesn't pass it, so the query can't execute properly:

// Wrong: No connection passed
$data = mysqli_query("SELECT * FROM characters WHERE $field LIKE'%$find%'");

// Correct: Include the $link parameter
$data = mysqli_query($link, "SELECT * FROM characters WHERE $field LIKE '%$find%'");

Without the connection, $data will return false, and mysqli_num_rows($data) will evaluate to 0—hence the "no records" message.

2. Add error checking to debug query failures #

Right now, you have no way to see if your SQL query is failing silently. Add this check right after your query to catch syntax errors or other issues:

$data = mysqli_query($link, "SELECT * FROM characters WHERE $field LIKE '%$find%'");
if (!$data) {
    die("Query failed with error: " . mysqli_error($link));
}

This will show you exactly what's wrong with the query instead of just showing no results.

3. Fix SQL injection vulnerabilities (and avoid edge cases) #

While not the immediate cause of your issue, your current code has severe SQL injection risks. Plus, this can also lead to unexpected query behavior. Here's how to fix it:

• Validate the search field: Make sure the $field value is one of your allowed columns to prevent malicious input:

  $allowed_fields = ['first_name', 'surname', 'address', 'phonenumber'];
  if (!in_array($field, $allowed_fields)) {
      die("Invalid search field selected");
  }
  

• Use prepared statements for the search term: This prevents injection and handles special characters (like % or _) that might break your LIKE query:

  $stmt = mysqli_prepare($link, "SELECT * FROM characters WHERE $field LIKE ?");
  $search_term = "%{$find}%";
  mysqli_stmt_bind_param($stmt, "s", $search_term);
  mysqli_stmt_execute($stmt);
  $data = mysqli_stmt_get_result($stmt);
  

4. Trim whitespace from the search term #

Users often accidentally add leading/trailing spaces to their search input, which won't match records without those spaces. Clean up the input with:

$find = trim($_POST['find']);

Also, note that adding single quotes around the field name (like '$field') was a mistake—this tells MySQL to look for a string literal instead of a column name, which would never match any records. Stick to using the field name directly (after validating it!) without quotes.

Give these fixes a try, and your search should start working as expected.

内容的提问来源于stack exchange，提问作者natstv