MySQL LIKE Function Not Working

Question

I've got a really weird situation here. I'm building a
dynamic query to a MySQL database that uses the like operator in
the WHERE clause. It seems that for whatever reason, the LIKE part
isn't working. Here's the query:
SELECT DISTINCT model, makeID, engineID, partnum_oem,
partnum_goodyear, partnum_tendeco, partnum_gates, app_desc,
app_type, app_comment
FROM part
WHERE (year = '#attributes.year#')
<cfif attributes.make NEQ "">AND (makeID LIKE
'%#attributes.make#%')</cfif>
<cfif thisModel NEQ "">
AND (model LIKE '%#TRIM(ReplaceNoCase(thisModel, "|", "%' OR
model LIKE '%", "ALL"))#%')
</cfif>
<cfif thisEngine NEQ "">
AND (engineID LIKE '%#TRIM(ReplaceNoCase(thisEngine, "|",
"%' OR engineID LIKE '%", "ALL"))#%')
</cfif>
ORDER BY makeID, model
I turned on the debug output and here is the query it is
passing:
SELECT DISTINCT model, makeID, engineID, partnum_oem,
partnum_goodyear, partnum_tendeco, partnum_gates, app_desc,
app_type, app_comment FROM part WHERE (year = '2006') AND (makeID
LIKE '%Sterling%') AND (model LIKE '%L9500 Series%' OR model LIKE
'%L-Line%') AND (engineID LIKE '%Detroit Diesel Series 60 Diesel%')
ORDER BY makeID, model
Now, If I paste this query into NaviCat, it works perfectly
and returns the 3 expected results. If I replace the dynamic query
in the CF code with the static query, it works fine and gives me 3
results. However, when built dynamically, I get 0 results. Also
weird is that the values of the above query are exact matches for
what's in the DB (the LIKE part shouldn't even come into play!) and
still no results.
This is all run inside a custom tag, but I can see the
results directly through debug. I've used LIKE many times without
issue before, and obviously the query is right since it works when
hard-coded.
We are using CF 7.0.2 on Windows 2003 and MySQL 5.0 with the
J-Connector driver. I also tried this same code to the same data on
a MySQL 4.1 database using the CF built in driver for MySQL and got
the same result.
Anybody have any ideas?

Answer 1

I've never used REQUEST, but from what I understand it's just a generic way of saying $_GET or $_POST. Here a note from http://php.benscom.com/manual/en/reserved.variables.request.php
"Note: The variables in $_REQUEST are provided to the script via the GET, POST, and COOKIE input mechanisms and therefore could be modified by the remote user and cannot be trusted. The presence and order of variables listed in this array is defined according to the PHP variables_order configuration directive. "
Rule of thumb is if you are retrieving any data from an external source such as a form or $_GET, you should assume that the data might not be as you expect it. Hackers can manipulate data sent to your website to gain access to your database. So, never trust it.
e.g if you have a name field, and some ones name is O'Reily and your insert statement looks like this - 'INSERT INTO ....'  the ' between O & Reily would mess up your query as it will assume that ' marks the end of the query. Therefore you need to use a function called addslashes to the posted variable:
e.g
$name = addslashes($_POST['name']); // outputs O\'Reily
there are many ways to clean your data, I always write a function to clean $_GET & $_POST.
e.g $name = clean_data($_POST['name'];  where clean_data processes the data and returns a sanitised version.
do a google search for 'php sanitize/sanitise data', there are thousands of simple solutions to protecting your data.
Chris