MySQL/PHP - Query Form

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • Mike Cocker

    MySQL/PHP - Query Form

    Hello,

    I'm quite weak at PHP, so I was hoping to get some help understanding the
    below code. First off, I'm trying to create a "query form" that will allow
    me to display the results on my screen. I grabbed this code from the net
    hoping that I could tweak it for my needs. I'm using MySQL, PHP and IIS and
    they all are running fine. As the code is, it will display the form, but it
    won't display my result(s). Any suggestions?

    Cheers,

    <html>
    <head>
    <title>designpl ace.org search script</title>
    <meta name="author" content="Steve R, http://www.designplace .org/">
    </head>
    <!-- © http://www.designplace.org/ -->
    <body>

    <form name="form" action="search. php" method="get">
    <input type="text" name="q" />
    <input type="submit" name="Submit" value="Search" />
    </form>

    <?php

    // Get the search variable from URL

    $var = @$_GET['q'] ;
    $trimmed = trim($var) //trim whitespace from the stored variable

    // rows to return
    $limit=10;

    // check for an empty string and display a message.
    if ($trimmed == "")
    {
    echo "<p>Please enter a search...</p>";
    exit;
    }

    // check for a search parameter
    if (!isset($var))
    {
    echo "<p>We dont seem to have a search parameter!</p>";
    exit;
    }

    //connect to your database ** EDIT REQUIRED HERE **
    mysql_connect(" localhost","use rname","passwor d"); //(host, username,
    password)

    //specify database ** EDIT REQUIRED HERE **
    mysql_select_db ("database") or die("Unable to select database"); //select
    which database we're using

    // Build SQL Query
    $query = "select * from sales_report where repfirstname = \"%$trimmed% \"; //
    EDIT HERE and specify your table and field names for the SQL query

    $numresults=mys ql_query($query );
    $numrows=mysql_ num_rows($numre sults);

    // If we have no results, offer a google search as an alternative

    if ($numrows == 0)
    {
    echo "<h4>Result s</h4>";
    echo "<p>Sorry, your search: &quot;" . $trimmed . "&quot; returned zero
    results</p>";

    // google
    echo "<p><a href=\"http://www.google.com/search?q="
    . $trimmed . "\" target=\"_blank \" title=\"Look up
    " . $trimmed . " on Google\">Click here</a> to try the
    search on google</p>";
    }

    // next determine if s has been passed to script, if not use 0
    if (empty($s)) {
    $s=0;
    }

    // get results
    $query .= " limit $s,$limit";
    $result = mysql_query($qu ery) or die("Couldn't execute query");

    // display what the person searched for
    echo "<p>You searched for: &quot;" . $var . "&quot;</p>";

    // begin to show results set
    echo "Results";
    $count = 1 + $s ;

    // now you can display the results returned
    while ($row= mysql_fetch_arr ay($result)) {
    $title = $row["repfirstna me"];

    echo "$count.)&nbsp; $title" ;
    $count++ ;
    }

    $currPage = (($s/$limit) + 1);

    //break before paging
    echo "<br />";

    // next we need to do the links to other results
    if ($s>=1) { // bypass PREV link if s is 0
    $prevs=($s-$limit);
    print "&nbsp;<a href=\"$PHP_SEL F?s=$prevs&q=$v ar\">&lt;&lt;
    Prev 10</a>&nbsp&nbsp;" ;
    }

    // calculate number of pages needing links
    $pages=intval($ numrows/$limit);

    // $pages now contains int of pages needed unless there is a remainder from
    division

    if ($numrows%$limi t) {
    // has remainder so add one page
    $pages++;
    }

    // check to see if last page
    if (!((($s+$limit)/$limit)==$pages ) && $pages!=1) {

    // not last page so give NEXT link
    $news=$s+$limit ;

    echo "&nbsp;<a href=\"$PHP_SEL F?s=$news&q=$va r\">Next 10 &gt;&gt;</a>";
    }

    $a = $s + ($limit) ;
    if ($a > $numrows) { $a = $numrows ; }
    $b = $s + 1 ;
    echo "<p>Showing results $b to $a of $numrows</p>";

    ?>

    <!-- © http://www.designplace.org/ -->

    </body>
    </html>



  • Michael Fesser

    #2
    Re: MySQL/PHP - Query Form

    .oO(Mike Cocker)
    [color=blue]
    >I'm quite weak at PHP, so I was hoping to get some help understanding the
    >below code. First off, I'm trying to create a "query form" that will allow
    >me to display the results on my screen. I grabbed this code from the net
    >hoping that I could tweak it for my needs. I'm using MySQL, PHP and IIS and
    >they all are running fine. As the code is, it will display the form, but it
    >won't display my result(s). Any suggestions?[/color]

    Any error messages? Is error_reporting set to E_ALL?
    [color=blue]
    > $var = @$_GET['q'] ;
    > $trimmed = trim($var) //trim whitespace from the stored variable[/color]

    Replace this with something like

    $trimmed = isset($_GET['q']) ? trim($_GET['q']) : '';
    [color=blue]
    >// check for a search parameter
    >if (!isset($var))
    > {
    > echo "<p>We dont seem to have a search parameter!</p>";
    > exit;
    > }[/color]

    I think you can remove this.
    [color=blue]
    >// Build SQL Query
    >$query = "select * from sales_report where repfirstname = \"%$trimmed% \"; //[/color]

    Use single quotes in the query. Additionally a double-quote is missing
    at the end of the string:

    $query = "select * from sales_report where repfirstname = '%$trimmed%'";

    And you shouldn't use SELECT *, but list all columns you want to
    retrieve explicitly instead.
    [color=blue]
    > $numresults=mys ql_query($query );
    > $numrows=mysql_ num_rows($numre sults);[/color]

    No error checking? What if the query fails and returns FALSE instead of
    a resource-ID?
    [color=blue]
    >// If we have no results, offer a google search as an alternative
    >
    >if ($numrows == 0)
    > {
    > echo "<h4>Result s</h4>";
    > echo "<p>Sorry, your search: &quot;" . $trimmed . "&quot; returned zero
    >results</p>";[/color]

    Never print out user-submitted data directly, use htmlspecialchar s()
    before (the code above is vulnerable to cross-site scripting attacks).
    [color=blue]
    >// next determine if s has been passed to script, if not use 0
    > if (empty($s)) {
    > $s=0;
    > }[/color]

    What is $s?

    If it's a variable passed by URL-parameters use $_GET['s'] instead. With
    register_global s=Off by default $s will always be empty.
    [color=blue]
    >// display what the person searched for
    >echo "<p>You searched for: &quot;" . $var . "&quot;</p>";[/color]

    Why do you use $var here instead of $trimmed?

    [rest of code snipped]

    Micha

    Comment

    • Mike Cocker

      #3
      Re: MySQL/PHP - Query Form

      > Any error messages? Is error_reporting set to E_ALL?

      Sorry. The message I get on my screen (in IE) is "Parse error: syntax error,
      unexpected T_IF in c:\Inetpub\wwwr oot\form.php on line 22."
      As for why there are certain variables declared in the code, I'm not
      entirely sure. I grabbed this code from the Internet from one of the "code
      sharing" sites. I was just hoping that I could use it because I think if the
      code works correctly, it'll do exactly what I'm aiming to do. I want to be
      able to query my MySQL database from a PHP form and then display the
      results. I'm going to make some of the changes that you proposed and get
      back ASAP. Thanks a bunch!

      Mike


      Comment

      • Good Man

        #4
        Re: MySQL/PHP - Query Form

        "Mike Cocker" <mcocker@swandu st.com> wrote in
        news:C8WdnWOuaK As68zcRVn-tQ@golden.net:

        <snip>[color=blue]
        > As for why there are certain variables declared in the code, I'm not
        > entirely sure. I grabbed this code from the Internet from one of the
        > "code sharing" sites. I was just hoping that I could use it because I
        > think if the code works correctly[/color]
        </snip>

        Do yourself a favor. Pick up a book, perhaps "PHP & MySQL Web
        Development" by Welling & Thompson. It's worth the time and money, you
        will learn more than you ever could via websites. Really.

        Comment

        Working...