mysql db durchsuchen

<?php
//-- pre-condition ---------------------------------------------------------------------------------





//-- example input ---------------------------------------------------------------------------------

$sSearch = $_GET['search'];

//--------------------------------------------------------------------------------------------------

function mysqlSearch($sSearch)
{
    // replace multiple whitespaces with a simple blank
    $aSearch = explode(' ', preg_replace('#\s+#', ' ', $sSearch));
    // count search words once
    $iSearch = count($aSearch);
    if ($iSearch == 0) {
        return array();
    }
    // remove addslashes (automatically executed by php) and use mysql_real_escape_string instead. it's more secure against sql injection
    if (get_magic_quotes_gpc()) {
        $aSearch = array_map('stripslashes', $aSearch);
    }
    $aSearch = array_map('mysql_real_escape_string', $aSearch);
    
    // get all tables in selected database
    $sSQL1 = 'SHOW TABLES';
    $rRes1 = mysql_query($sSQL1);
    
    // save hits
    $aHits = array();
    while ($aTable = mysql_fetch_array($rRes1)) {
        $sTable = $aTable[0];
        
        // get all columns from each table
        $sSQL2 = "SHOW COLUMNS FROM `$sTable`";
        $rRes2 = mysql_query($sSQL2);
        
        // combine search words with columns
        $aPermutation = array();
        while ($aColumn = mysql_fetch_assoc($rRes2)) {
            $sColumn = $aColumn['Field'];
            for ($i = 0; $i < $iSearch; $i++) {
                $sSearchword = $aSearch[$i];
                $aPermutation[] = "`$sColumn` LIKE '%$sSearchword%'";
            }
        }
        
        // combine as OR-condition
        $sSQL4 = "SELECT * FROM `$sTable` WHERE " . implode(' OR ', $aPermutation);
        $rRes4 = mysql_query($sSQL4);
        
        // collect result
        while ($aHit = mysql_fetch_assoc($rRes4)) {
            $aHits[$sTable][] = $aHit;
        }
    }
    
    return $aHits;
}

//-- example output --------------------------------------------------------------------------------

echo '<pre>', print_r(mysqlSearch($sSearch), true), '</pre>';

//--------------------------------------------------------------------------------------------------
?>

$qHotelsRegion_ID = mysql_query("SELECT 
ac.object_id, ac.name, ac.region_city_id, ac.region_id, ac.ort, ac.strasse, ac.hausnummer, ac.hotel_de_hotel_nr, ac.teilort, ac.ortplz FROM apx_objects AS ac WHERE ac.ort like '%".strtolower($CenterOrt)."%' OR ac.teilort like '%".strtolower($CenterOrt)."%' AND ac.region_id != 0 GROUP BY ac.region_id");

$query = "SELECT 
ac.object_id, ac.name, ac.region_city_id, ac.region_id, ac.ort, ac.strasse, ac.hausnummer, ac.hotel_de_hotel_nr, ac.teilort, ac.ortplz FROM apx_objects AS ac WHERE ac.ort like '%".strtolower($CenterOrt)."%' OR ac.teilort like '%".strtolower($CenterOrt)."%' AND ac.region_id != 0";
if (isset($_GET['strasse'])) {
    $strasse = strtolower(mysql_real_escape_string($_GET['strasse']));
    $query .= " AND strasse like '%" . $strasse . "%'";
}
$query .=" GROUP BY ac.region_id"

$qHotelsRegion_ID = mysql_query($query);