Search form/Results not filtered

[jarow]

I have a "search" form which posts to a result page showing the portion of a database that researchers can modify. On the search page I have put a hidden field that applies to them. In other words, if a researcher can modify the animal phylum "mollusca", I have created a hidden field "phylum" with a value of "mollusca" on the search page.

On the results page I (Dreamweaver) have placed the following query:

$varphylum_rsphylum = "%";
if (isset($_GET['phylum'])) {
  $varphylum_rsphylum = (get_magic_quotes_gpc()) ? $_GET['phylum'] : addslashes($_GET['phylum']);
}
mysql_select_db($database_connfauna, $connfauna);
$query_rsphylum = sprintf("SELECT * FROM newsp_taxon WHERE phylum LIKE '%%%s%%' ORDER BY orden, familia, taxon asc", $varphylum_rsphylum);
$rsphylum = mysql_query($query_rsphylum, $connfauna) or die(mysql_error());
$row_rsphylum = mysql_fetch_assoc($rsphylum);
$totalRows_rsphylum = mysql_num_rows($rsphylum);

simply put this is the query I am using

mysql_query=("SELECT *FROM newsp_taxon
WHERE phylum LIKE '%varphylum%'
ORDER BY orden, familia, taxon ASC")

varphylum has a default value of % and a runtime value of $_GET['phylum']

The problem is is that the result page shows ALL the records in the database and not just those with the value "mollusca".

Any idea what I am doing wrong???

Many thanks

Jarow

[zingbats]

Well... you need a user database. And a seperate query should select the user details.

[jimson]

i don't really know what your problem...

but '%%%s%%' is weird.. why cannot '%s%'...

[Weedpacket]

Rather than directly respond to your question, I'll instead advise something that would change the situation so much that a direct answer would be inapplicable.

Don't rely on anything coming from the client to be accurate - not even if it's something that was in a hidden vfield, and especially if you're going to have it on display in the URL; you just can't trust it. There is nothing stopping anyone from changing that field's contents, or discarding it completely.

Anything that has to remain trustworthy should not leave the server. I assume you're already keeping in the database details of which researchers can modify which phyla; you should consult those details in the database when they make a request, to see which phyla the researcher making the request can modify - don't trust them to be accurate when they tell you (no, it doesn't need to be deliberate or even conscious).

PS: "string with ".$interpolated." variable" is much faster (and easier to read) than sprintf("string with %s variable", $interpolated)