mysql - php search function failing with single quote entry -

this question has answer here:

• how can prevent sql injection in php? 28 answers

ok, have been on 1 hour now.. missing simple ? need new set of eyes on ? searched here , found few things , tried implement , still came short .

i have magic quotes turned off:

my search sam's club

in database entered : sam's club well

simple search function:

$q = htmlspecialchars($q); // changes characters used in html equivalents, example: < &gt; $q = mysql_real_escape_string($q); // makes sure nobody uses sql injection  $raw_results = mysql_query("select * this, this2 this.typeid = this2.typeid , this.status = 'active' , this.enddate >= curdate() , (`title` '%".$q."%')") or die(mysql_error()); 

still coming empty result?

obviously if search sam query result?

here 2 images phpmyadmin:

solved

i found problem. including list of functions in header forgot about. messing variable.

thanks troubleshooting! still learned ton!!

i suggest getting rid of htmlspecialchars() converting quote ' or '.

so when tries search database using sam's club or sam's club search, won't there because saved as: sam's club.

$q = mysql_real_escape_string($q); // makes sure nobody uses sql injection  $raw_results = mysql_query("select * this, this2 this.typeid = this2.typeid , this.status = 'active' , this.enddate >= curdate() , (`title` '%".$q."%')") or die(mysql_error()); 

please run , reply string generated.

$q = mysql_real_escape_string($q); echo "select * this, this2 this.typeid = this2.typeid , this.status = 'active' , this.enddate >= curdate() , (`title` '%".$q."%')";