数据表 + 服务器端处理 + 搜索过滤

Question

我正在关注本教程：
http://coderexample.com/datatable-demo-server-side-in-phpmysql-and-ajax/

这里是演示：
http://coderexample.com/demo/datatable-demo-server-side-in-phpmysql-and-ajax/

如果我在搜索输入中搜索ou，我会得到No matching records found，但我希望至少返回这一行Airi Satou。

this 是我必须更改的代码，我认为，因为我必须在搜索服务器端进行操作。

<?php
/* Database connection start */
$servername = "localhost";
$username = "root";
$password = "Password1";
$dbname = "test";

$conn = mysqli_connect($servername, $username, $password, $dbname) or die("Connection failed: " . mysqli_connect_error());

/* Database connection end */


// storing  request (ie, get/post) global array to a variable  
$requestData= $_REQUEST;


$columns = array( 
// datatable column index  => database column name
    0 =>'employee_name', 
    1 => 'employee_salary',
    2=> 'employee_age'
);

// getting total number records without any search
$sql = "SELECT employee_name, employee_salary, employee_age ";
$sql.=" FROM employee";
$query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees");
$totalData = mysqli_num_rows($query);
$totalFiltered = $totalData;  // when there is no search parameter then total number rows = total number filtered rows.


if( !empty($requestData['search']['value']) ) {
    // if there is a search parameter
    $sql = "SELECT employee_name, employee_salary, employee_age ";
    $sql.=" FROM employee";
    $sql.=" WHERE employee_name LIKE '".$requestData['search']['value']."%' ";    // $requestData['search']['value'] contains search parameter
    $sql.=" OR employee_salary LIKE '".$requestData['search']['value']."%' ";
    $sql.=" OR employee_age LIKE '".$requestData['search']['value']."%' ";
    $query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees");
    $totalFiltered = mysqli_num_rows($query); // when there is a search parameter then we have to modify total number filtered rows as per search result without limit in the query 

    $sql.=" ORDER BY ". $columns[$requestData['order'][0]['column']]."   ".$requestData['order'][0]['dir']."   LIMIT ".$requestData['start']." ,".$requestData['length']."   "; // $requestData['order'][0]['column'] contains colmun index, $requestData['order'][0]['dir'] contains order such as asc/desc , $requestData['start'] contains start row number ,$requestData['length'] contains limit length.
    $query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees"); // again run query with limit

} else {    

    $sql = "SELECT employee_name, employee_salary, employee_age ";
    $sql.=" FROM employee";
    $sql.=" ORDER BY ". $columns[$requestData['order'][0]['column']]."   ".$requestData['order'][0]['dir']."   LIMIT ".$requestData['start']." ,".$requestData['length']."   ";
    $query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees");

}

$data = array();
while( $row=mysqli_fetch_array($query) ) {  // preparing an array
    $nestedData=array(); 

    $nestedData[] = $row["employee_name"];
    $nestedData[] = $row["employee_salary"];
    $nestedData[] = $row["employee_age"];

    $data[] = $nestedData;
}



$json_data = array(
            "draw"            => intval( $requestData['draw'] ),   // for every request/draw by clientside , they send a number as a parameter, when they recieve a response/data they first check the draw number, so we are sending same number in draw. 
            "recordsTotal"    => intval( $totalData ),  // total number of records
            "recordsFiltered" => intval( $totalFiltered ), // total number of records after searching, if there is no searching then totalFiltered = totalData
            "data"            => $data   // total data array
            );

echo json_encode($json_data);  // send data as json format

?>

我可以说这是我必须更改的代码吗？
如果是这样，任何人都可以建议我该怎么做？
我知道这个问题很多，但希望得到指导！

Answer 1

 $sql.=" WHERE employee_name LIKE '".$requestData['search']['value']."%' "; 

将匹配搜索词然后任何内容（由于通配符 %）

由于您想匹配名称中间的搜索词，您还需要在乞求处添加通配符：

 $sql.=" WHERE employee_name LIKE '%".$requestData['search']['value']."%' ";

请注意，这将禁用employee_name 上的索引，这对您来说可能是也可能不是问题。

这并不是最好的搜索方法，您不应该检查所有三个字段，而是询问搜索者使用哪个字段。毕竟年龄和薪水可以有一些匹配的数字。

搜索 27，可以匹配 27 岁或 27000 工资等。而且没有人的 age 为 bob，因此进行该搜索毫无意义

Answer 2

您的查询需要更新。

以下 SQL 语句选择以“搜索字段值”开头的employee_name 的所有人：

   $sql.=" WHERE employee_name LIKE '".$requestData['search']['value']."%' "; 

因此，您的查询应该如下所示，以获得所需的输出，因为它检查员工姓名中是否存在特定模式。

   $sql.=" WHERE employee_name LIKE '%".$requestData['search']['value']."%' ";

Answer 3

按照您构建 Where 子句的方式，您要搜索的字段必须以搜索词开头。将 where 子句更改为

$sql.=" WHERE employee_name LIKE '%".$requestData['search']['value']."%' ";

您也可以通过做您正在做的事情来接受 SQL 注入。您需要使用参数化查询来消除此漏洞。有关信息，请参阅How can I prevent SQL injection in PHP?