Query Problem

laurie

I have moved one of my sites to a new server and now the following returns everything in the database regardless of what the user picks as their search criteria. It worked fine on the old server. Don't know if the problem is a different version of php... thus different syntax? (Obviously the code below is just a piece, but I think the problem is in this part.)

if ($keyword == "")
{$keyword = '%';}

if ($city == "")
{$city = '%';}

if ($category == "")
{$category = '%';}

$result = mysql_query("SELECT * FROM mibest
WHERE SearchWords LIKE '%$keyword%'
AND city LIKE '$city%'
AND category LIKE '$category%' ORDER BY title
");

if ($row = mysql_fetch_array($result)) {

jnuneznyc

Looks like it's a newer version of PHP and track globals is off

Try the following (Change $POST to $GET to match your form's method property)

if ($_POST['keyword'] == '') {
    $keyword = '%';
}else{
    $keyword = $_POST['keyword'];
}

if ($_POST['city'] == ''){
    $city = '%';
}else{
    $city = $_POST['city'];
}

if ($_POST['category'] == ''){
    $category = '%';
}else{
    $category = $_POST['category'];
}

keith73

just put this line before your if statements and query statement.

import_request_variables("gp");

this will import all POST or GET variables into the global space, creating those variables. This way, you don't have to rewrite all that code. In future code though, either use the $POST or $GET arrays.

keith

TIP, instead of doing
if($keyword =="")
do
if(trim($keyword) == "")
this will eliminate the possibility of someone just hitting the space bar and then submitting.

press711

bool import_request_variables ( string types [, string prefix])

Note: Although the prefix parameter is optional, you will get an E_NOTICE level error if you specify no prefix, or specify an empty string as a prefix. This is a possible security hazard. Notice level errors are not displayed using the default error reporting level.

Source: PHP Manual

If your code is not working because of a change in server that means the two servers have different configuration setings, or might be an unlikely case of php issues with that server.

I am assuiming that in the old server which you used register_globals were on whereas in the new one they are set off.

laurie

Thank you both for the suggestions. What worked was just putting the

import_request_variables("gp");

line in before the query line. It didn't work when I also put it in before the if statements.

http://www.michiganbest.com/

Thanks again!

keith73

sorry I guess I wasn't clear when I said

just put this line before your if statements and query statement.

I meant to put it at the top ONLY, which would be before the if statements which are before the query statements. I didn't mean for you to put it in BOTH places.

You should move it up above the if. Otherwise, what you do in the if statements will just get overwritten.

keith

laurie

Thanks again, Keith. I don't know if you were unclear, or whether I just misunderstood... probably the later! Anyway, I moved that line up above the if statements. Works great.