calculate search results

I made a code to search and display the results in a table (extracting data from my sql db) how to display number of resulting records?

here is my code:

$sel = $HTTP_POST_VARS[sel];

$Submit = $HTTP_POST_VARS[Submit];
$textfield=$HTTP_POST_VARS[textfield];
if ($Submit){

$sel="select * from lib where lib_name like '%$textfield%' order by lib_name asc";
$do_sel=mysql_query($sel);
$c=1;
while($get_sel=mysql_fetch_array($do_sel)){ ?>


<tr>
<td bgcolor="#FFFFCC"><p align="center"><?php echo $get_sel[lib_name];?></td>
<td bgcolor="#FFFFCC"><p align="center"><?php if($get_sel[lib_add] !== null) { echo $get_sel[lib_add]; }else{ echo "&nbsp;"; }?></p></td>
<td bgcolor="#FFFFCC"><p align="center"><?php if($get_sel[lib_tel] !== null) { echo $get_sel[lib_tel]; }else{ echo "&nbsp;"; }?></p></td>
<td bgcolor="#FFFFCC"><p align="center"><?php if($get_sel[lib_fax] !== null) { echo $get_sel[lib_fax]; }else{ echo "&nbsp;"; }?></p></td>
<td bgcolor="#FFFFCC"><p align="center"><?php if($get_sel[lib_mail] !== null){ echo $get_sel[lib_mail];}else{ echo "&nbsp;"; }?></p></td>


</tr>
<?php
$c++;
};
}?>

 

$do_sel=mysql_query($sel);
$number_of_records = mysql_num_rows($do_sel);
echo "<p>Number of records: {$number_of_records}</p>";

Code (markup):

 

your code is hackable..

 

Dear grikis,
what do you mean by hackable ? why ?
please tell me
thanks

 

You're not escaping your SQL queries - you need to use addslashes otherwise someone could POST textfield as

'; DELETE FROM lib;

and delete everything in your lib table. You want something like:-

$sel="select * from lib where lib_name like '%".addslashes($textfield)."%' order by lib_name asc";

 

Many thanks to all , helped me

thanks for solution ,joep1978

Is that injection ?

 

although your code is hackkable
you can count the search result from
your array result
ex : $search_count = count($get_sel);

 

That counts the columns (actually it gives you twice the number of columns, since $get_sel came from mysql_fetch_array()). I am pretty sure he wants to count the rows.

 

Hmmm I'm not sure about PHPs COUNT function but using "NUM_ROWS" is the easiest way to do it;

$q="select * from sometable";
$r=mysql_query($q) or die(mysql_error());
[COLOR="Red"]$numrows=mysql_num_rows($r);[/COLOR]

Code (markup):