[RESOLVED] Very Noob, needing a little query help

cescesc

Hi Guys,

I am very new to this forum, but a friend recommended it so here i am.

My Problem

I want to be able to search my MySQL database for a specific value, from a users input into a text field.

my code is basic at the moment.

srch1.htm

<form action="srch1.php" method="post">
 <p>Your Username: <input type="text" name="User" /></p>
 <p><input type="submit" /></p>
</form>

I then want to use the "User" input to search the database using the following php

srch1.php


<?php

// Connect to  Database 
mysql_connect("DELETED", "DELETED", "DELETED") or die(mysql_error()); 
mysql_select_db("DELETED") or die(mysql_error()); 

//Sets Up Query... this one shows all items booked on a specific day
$data = mysql_query("SELECT * FROM Booking WHERE Date =$_POST['User']") 
or die(mysql_error()); 

// Displays Result
Print "<table border cellpadding=3>"; 
while($info = mysql_fetch_array( $data )) 
 { 
 Print "<tr>"; 
 Print "<th>Entry Id:</th> <td>".$info['EntryID'] . "</td> "; 
 Print "<th>Date:</th> <td>".$info['Date'] . "</td> "; 
 Print "<th>Day:</th> <td>".$info['Day'] . "</td> "; 
 Print "<th>Month:</th> <td>".$info['Month'] . "</td> "; 
 Print "<th>Year:</th> <td>".$info['Year'] . "</td> "; 
 Print "<th>User:</th> <td>".$info['name'] . "</td> "; 
 Print "<th>Horse:</th> <td>".$info['Horse'] . "</td> "; 
 Print "<th>Notes:</th> <td>".$info['Notes'] . " </td></tr>"; 
 } 
 Print "</table>"; 


?>
</body>
</html>

The error i get is

Parse error: syntax error, unexpected T_STRING in /home/st1132/public_html/website_v3_sgray/tabletestday6.php on line 25

Any Help would be greatly appreciated.

Thank you in advance

Cescesc 😕

bradgrafelman

Welcome to PHPBuilder! Looks like there are a lot of errors in your code... here's several that I see:

First and foremost, your parse error is caused by the associative array rerefence inside of a double string. Take a thorough read through this (Arrays :: Why is $foo[bar] wrong?) part of the PHP manual to see how you can properly reference the contents of an associative array.
After fixing PHP problems, you'll find that you've got some MySQL problems as well.

First, however, I must warn you: User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (for string data).
Also, DATE is a MySQL column type, so you'll probably have to surround the word "Date" in your SQL query with backticks (or double quotes, depending upon the SQL mode) so that MySQL knows it's an identifier and not a special keyword.
String values in SQL queries must be quoted (with single quotes) just as they must be in PHP - your query is missing quotes around what I can only assume is supposed to be a string value.
Why are you searching the 'Date' column after asking for a username?
You've got a ton of invalid HTML markup - don't forget about that aspect as well.

cescesc

Thank you very much for your reply, I have addressed the issues and now have a working php file 😃

Thanks again

Happy Cescesc 😃

bradgrafelman

Don't forget to mark this thread resolved (if it is) using the link on the Thread Tools menu above.