[RESOLVED] php / mysql search results return

rxtx

Hi there- new to PHP and would really appreciate a little bit of help with something really quite trivial.

Basically I am searching an SQL DB with text brought in from an HTML form. I've checked and the correct string is being passed to the query. I am trying to return the value "cvalid" from the row which is returned based on the search for $lookup in "cname".

$lookup = $_POST['user'];

$sql = "SELECT cvalid FROM user WHERE cname = '$lookup'";

$result = mysql_query($sql) or die('mssg to be confirmed');

// test result display

echo $lookup;
echo $result;

It seems to return the correct $lookup, but "Resource id #5" as the $result. What am I doing wrong? Cheers 🙂

bradgrafelman

rxtx wrote:
It seems to return the correct $lookup, but "Resource id #5" as the $result. What am I doing wrong?

You're not doing anything wrong at all - you used the [man]mysql_query/man and the function successfully returned a MySQL resource.

If you want to know why it did not output the correct value, that's another story. To retrieve rows, you'll have to use one of the MySQL retrieval functions. Are you just trying to retrieve one column from one row? If so, I'd suggest using the [man]mysql_result/man function.

Also, some other tips:

You are vulnerable to SQL injection (I don't know if magic_quotes_gpc is on or not, but I wouldn't depend on it anyway)
If you only want one row from the table, I would add a "LIMIT 1" onto the end of your query.

rxtx

Thanks very much for the swift reply. I see exactly what I wasn't doing!

Also cheers for the advice on injection- this is just some offline code on a box without a connection, so I'll look into tidying it up when it goes live (Godforbid!)

Cheers. 🙂