PHP MYSQL Database

Discussion in 'PHP' started by gazza52_2000, Aug 10, 2007.

  1. #1
    Hi,

    I have created a database called cp1079 with the table details.

    I have created a form which lets me search for partial or full details on the following fields, name, telephone number, birthday.

    When you enter these details it passes you to the results page and possible results are returned.

    If i enter a partial name it will not display any results or even if i put the exact name of how it is written in the database it will not recognise it.

    I know my table is set up correctly because if i hardcode the variables it returns different queries fine.

    Here is my code

    search.html ---- the search form

    <HTML>
    <HEAD>
    <TITLE>Part 1 - Form</TITLE>
    </HEAD>
    <BODY>
    <form method="post" action="results.php" target="_blank">
    <div align="center">
    <table border="0" cellpadding="0" cellspacing="0">
    <tr>
    <td bordercolor="#000000">
    <p align="center">
    <select name="metode" size="1">
    <option value="name">Name</option>
    <option value="telephone">Telephone</option>
    <option value="birthday">Birthday</option>
    </select> <input type="text" name="search" size="25"> &nbsp;<br>
    Search database: <input type="submit" value="Go!!" name="Go"></p>
    </td>
    </tr>
    </table>
    </div>
    </form>
    </body>
    </HTML>

    The results page. results.php

    <HTML>
    <HEAD>
    </HEAD>
    <BODY>
    <center>
    <table border="1" cellpadding="5" cellspacing="0" bordercolor="#000000">
    <tr>
    <td width="60"><b>id</b></td>
    <td width="100"><b>name</b></td>
    <td width="70"><b>telephone</b></td>
    <td width="150"><b>birthday</b></td>
    </tr>
    <tr>
    <td>
    <? $hostname = "localhost"; // The DB server.
    $username = "root"; // The username you created for this database.
    $password = ""; // The password you created for the username.
    $usertable = "details"; // The name of the table you made.
    $dbName = "cp1079"; // This is the name of the database you made.

    MYSQL_CONNECT($hostname, $username, $password) OR DIE("DB connection unavailable");
    @mysql_select_db( "$dbName") or die( "Unable to select database");
    ?>
    <?
    //error message (not found message)begins
    $XX = "No Record Found, to search again please close this window";
    //query details table begins
    $query = mysql_query("SELECT * FROM $usertable WHERE $metode = '%$search%' LIMIT 0, 50");
    while ($row = @mysql_fetch_array($query))
    {
    $variable1=$row["id"];
    $variable2=$row["name"];
    $variable3=$row["telephone"];
    $variable4=$row["birthday"];
    //table layout for results

    print ("<tr>");
    print ("<td>$variable1</td>");
    print ("<td>$variable2</td>");
    print ("<td>$variable3</td>");
    print ("<td>$variable4</td>");
    print ("</tr>");
    }
    //below this is the function for no record!!
    if (!$variable1)
    {
    print ("$XX");
    }
    //end
    ?>
    </table>
    </center>
    </body>
    </HTML>

    Please help

    Gary
     
    gazza52_2000, Aug 10, 2007 IP
  2. Galen

    Galen Peon

    Messages:
    11
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Try this

    $query = mysql_query("SELECT * FROM $usertable WHERE $_POST['metode'] like '%$search%' LIMIT 0, 50"); 
    Code (markup):
    $metode will only work if register_globals is on, which it should never be
     
    Galen, Aug 10, 2007 IP
  3. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #3
    register_globals should be used as much as unfiltered GPC variables in query strings - Never.
     
    nico_swd, Aug 10, 2007 IP
  4. gazza52_2000

    gazza52_2000 Peon

    Messages:
    13
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Hey, thanks both for your help.

    I've got it to work now with just creating the variables myself and using the post comment.


    Gary
     
    gazza52_2000, Aug 10, 2007 IP