Search MySQL Data

tkmluv

I just stated learning PHP this morning and have come into a problem I cant get past. I think the problem is with my form but I am not sure.

I am writing an address book type app for my work and I have gotten everything working..ie pulling from DB, updating DB but I cant seem to run a search. Is there anything I am missing? Here is this code:

<?PHP

INCLUDE 'settings/connect.php';
INCLUDE 'include/functions.inc';

session_start();

top();

if (@$_GET['Action'] == "Search")
{

mysql_select_db("my_db", $conn);

$query = "select * from data where Number='$Number' and DID1='759' Order By Number";

echo "$query";   //Just have these here so I can see what query is being run. Nnot sure which one works.
echo $query;

$result = mysql_query($query) or die ("Couldn't execute SELECT query!");

echo "<div align='right'><a href='search.php'>Search Again</a></div>";
echo "<table border=1 width='600'><tr><td align='center' width='75'><b>Number</b></td><td align='center'><b>User</b></td><td align='center'><b>Data</b></td><td align='center'><b>Available</b></td><td align='center' width='45'><b>Type</b></td><td align='center' width='45'><b>Edit</b></td></tr>";

while ( $data = mysql_fetch_assoc($result))
{
    extract($data);
    echo "<tr>\n<td align='center'>".$Number."</td>\n";
    echo "   <td>&nbsp;&nbsp;".$Name."</td>\n";
    echo "   <td align='center'>".$DID2."&nbsp;</td>\n";
    echo "   <td align='center'>".$Available."&nbsp;</td>\n";
    echo "   <td>";
        If ($DID1 == '759')
        {
            echo "&nbsp;Fax";
        }
        else
        {
            echo "&nbsp;Phone";
        }
        echo "</td>\n";
    echo "   <td align='center'><a href='edit.php?Action=Edit&Number=".$Number."&DID=".$DID1."'>Edit</a></td>\n";
    echo "   </tr>\n";

}

}

else

{

echo "<p>&nbsp;<form action='search.php?Action=Search' method='POST'><table>\n";
echo "<tr><td colspan='2'>Search for: <input type='text' name='value' value='$Value'></td>\n";
echo "<td><input type='radio' name='type' value='UserS'>User&nbsp;&nbsp;&nbsp;</td>\n";
echo "<td><input type='radio' name='type' value='NumberS'>Phone Number</td></tr>\n";
echo "<tr><td colspan='3'><br><input type='hidden' name='Action' value='Search'>\n<input type='Submit' name='Submit' value='Search'></td><tr>\n";
echo "</table></form>";

}

foot();

?>

I tried having the following code where the select is but I cant even get it to run a query so i know it has lots of problems. Basicly I want the radio buttons to select which table field to search for data..... (replaces: $query = "select * from data where Number='$Number' and DID1='759' Order By Number"; )

    if (@$_GET['type'] == 'UserS')
    {

$query = "select * from data where Name='$Value' and DID1='759' Order By Number";

}
elseif (@$_GET['type'] == 'NumberS')
{
$Number = $_GET['Number'];
$query = "select * from data where Number='$Value' and DID1='759' Order By Number";
}

Any Ideas?

Thanks for the help,

Keith

Sanoz0r

$query = "select * from data where Number='$Number' and DID1='759' Order By Number";

It's possible that Number or/and DID1 are Integer types. In that case you must remove the quotes. Such as:

$query = "select * from data where Number=$Number and DID1=759 Order By Number";

tkmluv

No, all of my datatypes are VARCHAR

bradgrafelman

In your query, you use $Value when you never define this variable. You did define $Number, but only in the elseif() block of code. You should define this variable outside the if/elseif statement so that it is available to both and then use the correct variable in the query.

Also note some other issues with your code:

Using @$GET isn't good coding practice. Instead, check if the variable exists using [man]isset/man. Example:
```
$type = (isset($_GET['type']) ? $_GET['type'] : '');
```
Performing a "SELECT " is often wasteful. Instead, only SELECT the columns that you need data from.
You indicated that all columns are VARCHAR. While you may be focused on learning PHP, you should also consider learning good database design as well - make sure you're using appropriate column types for the data that they are to hold. While numeric values shouldn't have quotes, using them won't break the query.
You appear to be vulnerable to SQL injection attacks. You should never place user-supplied data directly into a SQL query. Instead, sanitize the data first using a function such as [man]mysql_real_escape_string/man (or if you're expecting an integer, cast it to an integer or use [man]intval/man).