Some random thoughts.
First, your first post looks much better than the code in the 'results page', like that for() loop is nasty! Some other random tips are, consider this:
if (!$result = @mysql_query($sql)) {
echo "Unable to run query ($sql) : " . mysql_error();
exit;
}
See how we combined your two statements into one? Also the @ was added because you/we are doing our own error handling so it supresses PHP's error, if that makes sense, and just prints ours. But don't blindly use @ everywhere!
Also, you may find extract() handy for the following reason:
$sql = "SELECT name, email, phone FROM users";
if (!$result = @mysql_query($sql)) {
echo "Unable to run query ($sql) : " . mysql_error();
exit;
}
while ($row = mysql_fetch_assoc($result)) {
extract($row);
print "$name $email $phone";
}
See how nice (and dangerous) that can be? Read the manual page for all the various options extract() provides.
Also, if you just want an associative array use mysql_fetch_assoc instead of mysql_fetch_array() as mysql_fetch_array fetches both numerical and associative by default, which is silly IMHO.
Also, no need for the ()'s with echo, or exit. Just use echo 'foo'; although this is personal preference, I prefer without though 🙂
Also your use of trim() is incorrect, you really want: $a = trim($a) not just trim($a);
And lastly, your search results page only checks for empty search queries as errors, what if I search for: foobarblahblahblah? Oh when I said the use of for() is nasty, I see you did it because you want 0-n printed along side, well, do something along these lines:
if (($count = mysql_num_rows($result)) > 0) {
echo "You have $count results...";
$i = 1;
while ($row = mysql_fetch_assoc($result)) {
extract($row);
print "<p>$i : $type : $year : $specs</p>";
$i++;
}
} else {
echo "You have zero results...";
}
Also, I see no reason why you'd need to stripslashes() on data coming from the database, if you have extra slashes in there then that's bad. That would mean you used addslashes() twice before entering it, sometimes this happens when people aren't aware of the power of the PHP directive magic_quotes_gpc as when on it essentially runs addslashes() on all GetPostCookie data. Same applies to your search query.
Also, not sure why htmlspecialchars() would be needed on output either, unless used inside a form element or something, but it won't hurt.
And lastly (no really I mean it), you may not want to spew out mysql_error() or sql queries on a production site if errors happen but instead implement some form of error handling that provides (includes) a static html page instead, with a more user friendly error.
