Any PHP Guru's?

[Quackers]

Always wanted to learn getting PHP and SQL talking together, so given it a bit of time this week. Now I'm a little stuck......

 

Can anybody tell me what i am doing wrong with the %$searchq% part on the SELECT statement?

 

Its a simple box, you type in your query into the text box, i.e. Period 4 and it should list all the rows that match Period 4, but its instead returning ALL rows.

 

If i change the code on the select statement from %$searchq% to say Period 4 it returns just the ones matching Period 4.

 

So im not sure whats wrong, why it does not like it being typed in the box.

 

mysql_connect("localhost","root","root") or die ("Could not connect to server!!");
mysql_select_db("testdata") or die ("could not find db");

$output = '';
//collect

if(isset($_POST['search'])) {
$searchq = $_post['search'];
$searchq = preg_replace("#[^0-9a-z]#i", "", $searchq);
$query = mysql_query("SELECT * FROM oncallinfo WHERE period LIKE '%$searchq%'") or die ("could not search!");
$count = mysql_num_rows($query);
if($count == 0) {
	$output = 'There was no search results!';
}else{
	while ($row = mysql_fetch_array($query)) {
		$periodname = $row['period'];
		$infoname = $row ['info'];
		$id = $row['infoid'];

		$output .= '' .$periodname. ' '.$infoname.''; 
	}

}

}

?>

</pre><form action="oncallinfo.php" method="post">


</form><br><b

[unixman_again]

I'm guessing the escaping is getting confused - you will need mysql_real_escape_string().

 

Of course, really you should use mysqli...

[zag]

I don't think you can use wildcards at the beginning a LIKE statement, try with =

 

Also you don't need the apostrophes, php can use inline variables.

 

Lastly use something like ezSQLJustin Vincent It will make learning so much easier. That code could be a couple of lines instead of all that mysql connect stuff.

 

Oh and if you want to escape it do this ".add_slashes($search)."

Edited March 20, 2015 by zag

[Dkeen94]

I have actually done something just like this but for a friends Minecraft server using an input form and taking that data and searching a database.

 

PM if you want some help.

[Quackers]

Hmm got a little further, i added

 

<?php print ("$searchq");?>

 

To the end so i could see on screen what it thinks is in the text box and its always blank, so thats why its return all rows from the table as its searching for "".

 

So its got to be something wrong with this part

 

if(isset($_POST['search'])) {

$searchq = $_post['search'];

 

or the Form part at the bottom.

[webman]

Variable names are case-sensitive, so $_post is different to $_POST. Only $_POST is a recognised "superglobal", so it needs to be uppercase

[Quackers]

It works now, was the lowercase POST. I hope one day this will all just come naturally. I have been racking my brain over this all morning.

[Willott]

Just wait until you miss a single semicolon somewhere and it tells you the error is about 30 lines further down...

[Quackers]

Just wait until you miss a single semicolon somewhere and it tells you the error is about 30 lines further down...

 

That was all day yesterday

 

Problem I'm finding now is everyone has different ways of doing things and I'm having to flip tutorial authors on youtube to achieve different things. Such as one tutorial was using sql and another sqli and i did not notice it until unixman pointed out i should be using sqli .

[danbuntu]

 

Of course, really you should use mysqli...

 

probably PDO actually