Find jobs - Kamala Harris - Internet Advertising - Gavin Newsom - Property in Malaysia

PDA

View Full Version : PHP MYSQL Database


gazza52_2000
Aug 10th 2007, 7:23 am
Hi,

I have created a database called cp1079 with the table details.

I have created a form which lets me search for partial or full details on the following fields, name, telephone number, birthday.

When you enter these details it passes you to the results page and possible results are returned.

If i enter a partial name it will not display any results or even if i put the exact name of how it is written in the database it will not recognise it.

I know my table is set up correctly because if i hardcode the variables it returns different queries fine.

Here is my code

search.html ---- the search form

<HTML>
<HEAD>
<TITLE>Part 1 - Form</TITLE>
</HEAD>
<BODY>
<form method="post" action="results.php" target="_blank">
<div align="center">
<table border="0" cellpadding="0" cellspacing="0">
<tr>
<td bordercolor="#000000">
<p align="center">
<select name="metode" size="1">
<option value="name">Name</option>
<option value="telephone">Telephone</option>
<option value="birthday">Birthday</option>
</select> <input type="text" name="search" size="25"> &nbsp;<br>
Search database: <input type="submit" value="Go!!" name="Go"></p>
</td>
</tr>
</table>
</div>
</form>
</body>
</HTML>

The results page. results.php

<HTML>
<HEAD>
</HEAD>
<BODY>
<center>
<table border="1" cellpadding="5" cellspacing="0" bordercolor="#000000">
<tr>
<td width="60"><b>id</b></td>
<td width="100"><b>name</b></td>
<td width="70"><b>telephone</b></td>
<td width="150"><b>birthday</b></td>
</tr>
<tr>
<td>
<? $hostname = "localhost"; // The DB server.
$username = "root"; // The username you created for this database.
$password = ""; // The password you created for the username.
$usertable = "details"; // The name of the table you made.
$dbName = "cp1079"; // This is the name of the database you made.

MYSQL_CONNECT($hostname, $username, $password) OR DIE("DB connection unavailable");
@mysql_select_db( "$dbName") or die( "Unable to select database");
?>
<?
//error message (not found message)begins
$XX = "No Record Found, to search again please close this window";
//query details table begins
$query = mysql_query("SELECT * FROM $usertable WHERE $metode = '%$search%' LIMIT 0, 50");
while ($row = @mysql_fetch_array($query))
{
$variable1=$row["id"];
$variable2=$row["name"];
$variable3=$row["telephone"];
$variable4=$row["birthday"];
//table layout for results

print ("<tr>");
print ("<td>$variable1</td>");
print ("<td>$variable2</td>");
print ("<td>$variable3</td>");
print ("<td>$variable4</td>");
print ("</tr>");
}
//below this is the function for no record!!
if (!$variable1)
{
print ("$XX");
}
//end
?>
</table>
</center>
</body>
</HTML>

Please help

Gary

Galen
Aug 10th 2007, 7:53 am
Try this

$query = mysql_query("SELECT * FROM $usertable WHERE $_POST['metode'] like '%$search%' LIMIT 0, 50");

$metode will only work if register_globals is on, which it should never be

nico_swd
Aug 10th 2007, 8:01 am
register_globals should be used as much as unfiltered GPC variables in query strings - Never.

gazza52_2000
Aug 10th 2007, 8:19 am
Hey, thanks both for your help.

I've got it to work now with just creating the variables myself and using the post comment.


Gary