Execute a query with a link

> if the user submits more than one keyword at a time, such as "chevy dodge" or
> "chevy s10" in the form. I have records with both contained in them, but if I
> search for one of the above examples, I get no results. Any recommendations on
> making my SQL work better?

You need, then, to treat your keywords as a list of items (delimited by a
space), not one solitary item. And you'll need to check for a match for
each of them.

--
Adam

> I appreciate your recommendation for me to use <cfqueryparam>, but honestly,
> I don't know how to use it.

How about after reading the docs:
http://livedocs.macromedia.com/coldfusion/7/htmldocs/00000317.htm

--
Adam

> and times where it is not.

What's an example of when it's not?

--
Adam

I understand. Here's why I made my SQL what it is: I wanted the query to pull and display any entry that even remotely resembled the user's form entry (FORM.Keywords). It works like I want it to, but now I've been asked to make "popular search" links for items such as "Chevy", "Ford", "Dodge", "Camper Shells", etc. By the way, you're correct about it not yielding correct results if the user submits more than one keyword at a time, such as "chevy dodge" or "chevy s10" in the form. I have records with both contained in them, but if I search for one of the above examples, I get no results. Any recommendations on making my SQL work better?

I appreciate your recommendation for me to use <cfqueryparam>, but honestly, I don't know how to use it.

I didn't advise you to not use cfqueryparam. There are times where it is a good idea and times where it is not. Based on what I have read so far, in your case, it probably is.

My comments concerned sql injection. Here is some information on it: http://www.adobe.com/devnet/security/security_zone/asb99-04.html

Getting back to your application, your sql will work but it's not very efficient to apply the same keyword to more than one field like that. Also, I am not sure if your approach will give you the desired result if the user submits more than one keyword.

Believe me, I would if I knew how and knew that it would get this thing to work. I literally need someone to explain how to do this in depth.

Also, as of now, I'm going to take Dan's advice. He's posted over 3000 times, likely, not out of ignorance. Besides, if someone REALLY wants to get in and destroy my database, they can go for it. It's very small and I have a backup. Thanks for your help, though.

YOU REALLY HAVE TO USE CFQUERYPARAM.

There are soo many reasons why you should. Just cos this other dude couldn't get sql injection to work, doesn't mean that lots of other people in the world can't

Ok, here's what my current query looks like:

<cfquery name="PicSearch" datasource="truckers">
SELECT *
FROM Pictures
WHERE ( (Make LIKE '%#FORM.Keywords#%')
OR (Model LIKE '%#FORM.Keywords#%')
OR (Caption LIKE '%#FORM.Keywords#%') )
</cfquery>

What do I need to add in order to make a link that pulls, say, only WHERE make, model, or caption contains "chevy?" I really am a CF noob of sorts, and. for what it's worth, you're talking over my head. I need someone to explain all the elements I need to have in place in order for this to work. If I need to modify the query, make a new query, or otherwise.

Here's my search form as well:

<form action="gallery.cfm" method="post">
Search Pictures:
<cfoutput>
<input type="text"
name="keywords"
size="30"
maxlength="50"
value="#FORM.Keywords#">
</cfoutput>
<input type="submit" value="Search">
</form>

I really appreciate your help so far...

For all those waving the sql injection flag, have you ever been able to successfully do it in a text field? I've tried and the query either crashed, or the sql was treated as regular text.

I could get the sql to execute in numeric fields, but not text.

jeez guys...
When you are lettings users enter SQL into your system, you have to be very very very careful.

Use <cfqueryparam> this will not only type your variable and prevent SQL injection, but it will also help performance by allowing CF to cache the underlying preparedStatement