this is what I have so far:

<?php
include "config.php";
if (@$_POST['search']=="search")
{
$keyword=$_POST['keyword'];
$result=mysql_query("SELECT * FROM listed WHERE `itemname` LIKE ‘%$keyword%’ OR `message1` LIKE ‘%$keyword%’");
while ($results = mysql_fetch_array($result))
{
$tag=$results['tag'];
$idno=$results['id'];
$title=$results['name'];
$description=$results['message1'];
$position=40;

$post = substr($description, 0, $position);

echo "<b>$tag,$title,$post,$idno</b>
?>

I also heard of adding a thing called noslashes or something which is supposed to prevent unwanted SQL queries. Any info on that?

Technorati Tags: , , ,