Yup, mysite/_config.php.

You can replace that filter clause with whatever database fields you want to search on..

got it working!!
i added the column name "Title" and now it searches perfectly, and the results are pretty much EXACTLY how i was hoping!

one last thing, how do i search more than one table column?
ideally, I'd like to search the whole table, is there a way i can name the table rather than every column?

here's mu updated function:

public function doProductSearch($data, $form) {
if(isset($data['s'])) {
$filter = "Title LIKE '%".Convert::raw2sql($data['s'])."%'";
}

the table itself is called Product, but when i tried that it threw up the same error as before.

Multiple filters:

I would first define an array $searchable_fields on your Product object. Then:

public function doProductSearch($data, $form) {
if(isset($data['s'])) {
$filters = array();
foreach(Product::$searchable_fields as $field) {
$filters[] = "$field LIKE '%".Convert::raw2sql($data['s'])."%'";
}
$filter = implode(" OR ", $filters);
// etc...
}

For the security ID issue, that's going to be a problem. The pagination isn't posting the form params with each page, which creates more issues than just the security ID.. I think you can solve that by setting your form method to "get", so the params are posted for every page through the URL.

public function ProductSearchForm() {
$f = new Form (
$this,
"ProductSearchForm",
new FieldSet(new TextField('s','')),
new FieldSet(new FormAction('doProductSearch','Search'))
);
$f->setFormMethod('get');
reutrn $f;
}

OK last question... i've set the field value to "Search by title"
but is there a way i can make that value become blank on focus?
usually i'd set these things in the form coding, but when forms are created via the .php files like this im not sure how to add variables like that!

usually i'd use this:
onClick="this.value=''"

but how do i implement that into a form when the form is generated by PHP like this? (amateur question im sure!)