[Resolved] SELECT Queries

Boudga

I can't figger out how to query my DB based on variable text entered in a text field and DB field names selected in a SELECT box in my form. I've posted the html and the PHP below and would be very grateful for some help.

PHP Below:

<?php

// DB connect info
$hostname = "127.0.0.1"; // Usually localhost.
$username = "client"; // If you have no username, leave this space empty.
$password = ""; // The same applies here.
$usertable = "partslist"; // This is the table you made.
$dbName = "Military_Catalog"; // This is the main database you connect to.
MYSQL_CONNECT($hostname, $username, $password) OR DIE("Unable to connect to database");
@mysql_select_db( "$dbName") or die( "Unable to select database");

// QUERY
$query = mysql_query("SELECT * FROM $usertable WHERE $ddb LIKE '%$start%' LIMIT 0,30 ") or die (mysql_error());

while ($row = mysql_fetch_array($query))

{

$partnum=$row["0"];

$nsn=$row["1"];

$top_level_kit=$row["2"];
$description=$row["3"];

$engine_used_on=$row["4"];

echo"		
<span style=\"font-family: Verdana, Geneva, Arial, helvetica, sans-serif; font-size: 11px; color: #444973; \">Part Number:</span> <span style=\" font: 9px verdana,arial; color:#717abf; font-weight: bold;\">$partnum</span><br />
<span style=\"font-family: Verdana, Geneva, Arial, helvetica, sans-serif; font-size: 11px; color: #444973; \">NSN:</span> <span style=\" font: 9px verdana,arial; color:#717abf; font-weight: bold;\">$nsn</span><br />
<span style=\"font-family: Verdana, Geneva, Arial, helvetica, sans-serif; font-size: 11px; color: #444973; \">Top Level Kit:</span> <span style=\" font: 9px verdana,arial; color:#717abf; font-weight: bold;\">$top_level_kit</span><br />
<span style=\"font-family: Verdana, Geneva, Arial, helvetica, sans-serif; font-size: 11px; color: #444973; \">Description:</span> <span style=\" font: 9px verdana,arial; color:#717abf; font-weight: bold;\">$description</span><br />
<span style=\"font-family: Verdana, Geneva, Arial, helvetica, sans-serif; font-size: 11px; color: #444973; \">Engine Used On:</span> <span style=\" font: 9px verdana,arial; color:#717abf; font-weight: bold;\">$engine_used_on</span> <br />

<hr noshade SIZE=1 color=#717abf>
";

};

// Error Results

if(mysql_num_rows($query)==0) {

echo"
<table height=100% width=100% valign=center>
<tr>
<td>
<center>
<span style=\"font-family: Verdana, Geneva, Arial, helvetica, sans-serif; font-size: 20px; color: #444973; font-weight: bold;\">
<a href=\"http://www.atec.com/db_any_query.php\">No results! Return to NSN Query</a>
</span>
</center>
</td>
</tr>
</table>
";
}

?>

HTML Below:

<html>
<head>
<title>ATEC Sample NSN Query Page</title>

</head>
<body>

<form name="search" method="post" action="search.php"> 

     <input name="start" type="text" size="50" maxlength="50" size="11" tabindex=1 style="font-family: verdana; font-size: 10px; border-color:#3871A9;border-width=1px;" />
	<?PHP
	$connection = mysql_connect("127.0.0.1","client",""); 
	$fields = mysql_list_fields("Military_Catalog", "partslist", $connection); 
	$columns = mysql_num_fields($fields); 
	echo "<select name=\"ddb\" size=\"1\" style=\"font-family: verdana; font-size: 10px; border-color:#3871A9;border-width=1px;\">"; 
	//echo "<option>Select Search Item</option>"; 
	//echo "<option>------------------</option>"; 
	for ($i = 0; $i < $columns; $i++) { 
	echo "<option value=$i>"; 
	echo mysql_field_name($fields, $i);
	echo "</option>";
	} 
	echo "</select>"; 
	?> 
	<br />				
     <input type="submit" name="Submit" value="search" size="11" tabindex=5 style="font-family: verdana; font-size: 10px; border-color:#3871A9;border-width=1px;" />
     &nbsp; 
     <input type="reset" name="Reset" value="Reset" size="11" tabindex=6 style="font-family: verdana; font-size: 10px; border-color:#3871A9;border-width=1px;" />
</form>

</body>
</html>

DigitalExpl0it

try this

<?
$connect = mysql_connect($hostname, $user_name, $user_pass) or die ("<b><center>".mysql_errno().": ".mysql_error()."</b></center>\n");
$db = mysql_select_db($database, $connect) or die ("<b><center>".mysql_errno().": ".mysql_error()."</b></center>\n");
$sql = "SELECT * FROM $usertable WHERE ".$_REQUEST["ddb"]." LIKE '%".$_REQUEST["start"]."%' LIMIT 0,30";
$result = mysql_query($sql) or die ("<b><center>".mysql_errno().": ".mysql_error()."</b></center>\n");

//Your Code here

mysql_close($connect);
?>

tbach2

The first question to answer is, are the variables getting passed to the script? You might be running into the 'global_vars=off' change in php4.

A good scripting practice to get in to would be to define your variables at the top of the page. You know how the variables are going to be passed to the script, and you allow them in only that way. Next, you need to be sure that malicious content cannot get in. Never trust a variable that is passed to your script! Using numbers as much as possible (as is $ddb) is a good practice.

<?php
$ddb = (int)($_POST['ddb']);
$start = addslashes($_POST['start']);

//  remainder of code...