php search database

kim_c

hi i am trying to make search for items in my database but its not wokring, here is the cod ehtat i have so far

<html>
<head>
<title> Media-O RAMA Catalog Search</title>
</head>

<body
<H1>Media-O RAMA Catalog Search</H1>
<?php
// create short variable names
  $searchtype=$HTTP_POST_VARS['searchtype'];
  $searchterm=$HTTP_POST_VARS['searchterm'];
  $searchterm= trim($searchterm) ;

if (!$searchtype || !$searchterm)
{
    echo 'You have not entered search details. Please go back and try again';
	exit;
}

$searchtype = addslashes($searchtype);
$searchterm = addslashes($searchtem);

@ $db = mysql_pconnect('localhost','user','pass');

if (!$db)
{
   echo 'Error: Could not connect to database. Please go back and try again';
	exit;
}

mysql_select_db('booksr');
$query = "select * from booksr where ".$searchtype." like '%".$searchterm."%'";
$result = mysql_query($query);

$num_results = mysql_num_rows_($result);

echo '<p>Number of books found: '.$num_result.'</p>';

for ($i=0; $i <$num_results; $i++);
{
    $row = mysql_fetch_array($result);
    echo '<p><strong>'. ($i+1).'.Title; ';
    echo htmlspecialchars(stripslashes($row['title']));
    echo '</strong><br />Author: ';
    echo stripslashes($row['author']);
    echo '<br />ISBN: ';
    echo stripslashes($row['ISBN']);
    echo '<br />Price: ';
    echo stripslashes($row['price']);
    echo '</p>';
}
?>

</body>
</html>

it keeps givng me this error code
Media-O RAMA Catalog Search
Notice: Undefined variable: HTTP_POST_VARS in G:\webclient\xampp\htdocs\web\results.php on line 10

Notice: Undefined variable: HTTP_POST_VARS in G:\webclient\xampp\htdocs\web\results.php on line 11
You have not entered search details. Please go back and try again

any help would be much appreciated

bradgrafelman

Welcome to PHPBuilder! When posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags as they make your code much easier to read and analyze.

As for your code, here are a few things I noticed:

The $HTTP*VARS long variable names have been deprecated and disabled by default for some time now; see [man]variables.external[/man] for more info about how external data should be accessed, and see [man]reserved.variables[/man] for more info about any of the reserved variables in general.
[man]addslashes/man should never be used to prepare data for a MySQL query. Instead, you should be using a DBMS-specific escaping mechanism such as [man]mysql_real_escape_string/man (for string data).
You might want to define an array of valid values for $searchtype; otherwise you could be allowing malicious users to execute arbitrary SQL code in a subquery.
You should not be using [man]stripslashes/man on data retrieved from the DB (since it isn't necessary).