[RESOLVED] Active Tables with PHP

agulaid

Im trying to design a search script which enables someone to click on a specific result in the search list, the user will then be able to click on a result and the product page will then load, the YouTube search feature is an example of what im trying to achieve. I can design a search feature but it only brings up a static result not containing any Active table data.

How would i go about doing this?, any suggestions would be appreciated.

sid

A handy information retrieval tool...

agulaid

sid wrote:
A handy information retrieval tool...

That is for general search scripts, the result cannot be clicked on. Can you suggest anything else. I would appreciate this.

Im looking for a Dynamic row that is clickable, this will allow you to click on the result.

sid

just wrap each result in a link - this really isnt so hard. if you post the code you have, i will gladly show you how to modify it.

agulaid

I want someone to be able to click on the results to view the property itself, this will take you to a dynamically generated page which gives you the full the details of the property including more pictures. This is a current project im doing at University and i have to hand this in within a month.

<?php

//if the form has been submitted with a supplied search criteria
if (isset($_POST['keyword']) || isset($_POST['propertytype']) || isset($_POST['rent_min']) || isset($_POST['rent_max']) || isset($_POST['bedrooms_min']) || isset($_POST['bedrooms_max'])) 
{

//connect to server and select database
$mysqldb = new mysqli("host", "user", "pass", "database");

//set the posted variables to convenient names




$field = $_POST['propertytype'];
$rent_min = $_POST['rent_min'];
$rent_max = $_POST['rent_max'];
$bedrooms_min = $_POST['bedrooms_min'];
$bedrooms_max = $_POST['bedrooms_max'];

//create the query
if (isset($_POST['keyword']) || isset($_POST['propertytype']) || isset($_POST['rent_min']) || isset($_POST['rent_max']) || isset($_POST['bedrooms_min']) || isset($_POST['bedrooms_max'])) {
	$result= $mysqldb->query("SELECT User_Name, Property_Details, To_Rent_Price FROM to_rent WHERE City= '$keyword'");

} else {
echo "Invalid search criteria has been entered";
}



	//if records found, output firstname, lastname and email field



	if ($result->num_rows > 0) {
	while ($row = $result ->fetch_object())
	echo "$row->User_Name, $row->To_Rent_Price $row->Property_Details<br />" ;

	} else {
	echo "No results found.";

	}
	}

	?>

sid

alright - i assume you have some sort of unique id in the "to_rent" table?

then modify this line

echo "$row->User_Name, $row->To_Rent_Price $row->Property_Details<br />" ;

to make it look like this

echo "<a href=\"details.php?classified_id=$row->id\">$row->User_Name, $row->To_Rent_Price $row->Property_Details</a><br />" ;

this will turn the result into a clickable line, going to the page details.php.
the file details.php will be responsible for - you guessed it - displaying the full details of the item. the requested item is the one, which has the id (in the to_rent table) $GET['classified_id']. so all you need to do in details.php is

SELECT *
FROM to_rent
WHERE id = $_GET['classified_id'];

and display the result however you like.

once you have this working, read up on security topics, such as sql injection!
i hope this helps!

agulaid

Im ever so greatful sir, thank you ever so much. I have learnt alot from just that.

sid

no problem - and dont forget to mark the thread as resolved!

agulaid

Sid im getting the following error message upon clicking on the result:
"Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in C:\Program Files\xampp\htdocs\details.php on line 35"

This is details.php

<?php




/*line 35 */ $sql= "SELECT * FROM to_rent WHERE id=$_GET['classified_id']";
$result= mysql_query($sql);


$row = mysql_fetch_array( $result );

?>


<div id="Layer1"><?php
echo "Details".$row['Property_Details'];
?></div>
<div id="Layer2"><?php echo " Ref ".$row['Property_Ref'];



?>

This is the edited search script:

<?php


if (isset($_POST['keyword']) || isset($_POST['propertytype']) || isset($_POST['rent_min']) || isset($_POST['rent_max']) || isset($_POST['bedrooms_min']) || isset($_POST['bedrooms_max'])) 
{


$mysqldb = new mysqli("localhost", "user", "pass", "database");






$field = $_POST['propertytype'];
$rent_min = $_POST['rent_min'];
$rent_max = $_POST['rent_max'];
$bedrooms_min = $_POST['bedrooms_min'];
$bedrooms_max = $_POST['bedrooms_max'];


if (isset($_POST['keyword']) || isset($_POST['propertytype']) || isset($_POST['rent_min']) || isset($_POST['rent_max']) || isset($_POST['bedrooms_min']) || isset($_POST['bedrooms_max'])) {
	$result= $mysqldb->query("SELECT User_Name, Property_Details, To_Rent_Price FROM to_rent WHERE City= '$keyword'");

} else {
echo "Invalid search criteria has been entered";
}







	if ($result->num_rows > 0) {
	while ($row = $result ->fetch_object())

/*you advised here*/echo "<a href=\"details.php?classified_id=$row->id\">$row->User_Name, $row->To_Rent_Price $row->Property_Details</a><br /> <br />" ; 


	} else {
	echo "No results found.";

	}
	}

	?>

sid

error on line 35...

if ($result->num_rows > 0) {

should be

if ($result->num_rows() > 0) {

agulaid

I got the following error after making the changes to the search script:

Fatal error: Call to undefined method mysqli_result::num_rows() in C:\Program Files\xampp\htdocs\searchextended.php on line 780

(Sorry for bothering you so much, im just new to this stuff and its quiet a learning curve)

sid

ok - that was my bad - i looked in the wrong file and also gave you a bogus answer - undo what i told you to change.

so the search script should look like this (with fixed indentation):

<?php
if (
    isset($_POST['keyword']) || 
    isset($_POST['propertytype']) || 
    isset($_POST['rent_min']) || 
    isset($_POST['rent_max']) || 
    isset($_POST['bedrooms_min']) || 
    isset($_POST['bedrooms_max'])
) {
    $mysqldb = new mysqli("localhost", "user", "pass", "database");

$field = $_POST['propertytype'];
$rent_min = $_POST['rent_min'];
$rent_max = $_POST['rent_max'];
$bedrooms_min = $_POST['bedrooms_min'];
$bedrooms_max = $_POST['bedrooms_max'];


if (
    isset($_POST['keyword']) || 
    isset($_POST['propertytype']) || 
    isset($_POST['rent_min']) || 
    isset($_POST['rent_max']) || 
    isset($_POST['bedrooms_min']) || 
    isset($_POST['bedrooms_max'])
) {
    $result= $mysqldb->query("SELECT User_Name, Property_Details, To_Rent_Price FROM to_rent WHERE City= '$keyword'");
}
else {
    echo "Invalid search criteria has been entered";
}

if ($result->num_rows > 0) {
    while ($row = $result ->fetch_object()) {
        /*you advised here*/
        echo "<a href=\"details.php?classified_id=" . $row->id . "\">" . $row->User_Name . ", " . $row->To_Rent_Price . " " . $row->Property_Details . "</a><br /><br />";
    }
}
else {
    echo "No results found.";
}
}
?>

try this line instead of yours in details.php (you need to concatenate the sting with the array element):

$sql= "SELECT * FROM to_rent WHERE id='" . $_GET['classified_id'] . "';";

bradgrafelman

Don't forget to sanitize every piece of user-supplied data before placing it in a SQL query (none of the above coding examples do) - otherwise, you're leaving yourself vulnerable to SQL injection attacks.

Also, as for the error message you are dealing with...

Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:

echo 'Your name is: ' . $row['name'] . '! Hello there.';

The same rule applies to objects and their properties; complex syntax or concatenation should be used.

sid

i just wanted to stress the sql injection issue again, since brad brought it up now too. otherwise you may end up with a shot database, exposed private information or defaced pages - amongst other possibilities.

agulaid

Thank you so much guys, ive made a lot of changes to the script and added all of your suggestions. Its working perfectly now, hopefully i will be as skilled as you guys in the future. You guys are inspirational. Thanks a million. 🙂

Where can i find more information on SQL injection? its something i would like to look into as you guys have suggested it.

bradgrafelman

agulaid wrote:
Where can i find more information on SQL injection? its something i would like to look into as you guys have suggested it.

Search the board or Google using that phrase and I'm sure you'll be inundated with information.