Re: Re: PHP Search DB Table

From: Date: Tue, 14 Dec 2010 12:10:16 +0000
Subject: Re: Re: PHP Search DB Table
References: 1 2 3  Groups: php.db php.windows 
Request: Send a blank email to php-db+get-47529@lists.php.net to get a copy of this message
David wrote: > > Oliver Kennedy wrote: > > ... > > I have a very simple database consisting of 1 table, I want users here > to > > be able to use a search function to query the database in order to > return > > the information on a client by a specific ID number if it is in the > > database. > > ... > > Try > > $query = "SELECT * FROM clients WHERE clientid = '$term'"; > echo $query . '<br />'; > $result = mysql_query($query); > > And see what is actually in the query. > > Cheers > -- > David Robley As David stated, output the query and copy it into the MySQL console, see if that gives you an error. You are talking about using an ID -number-, in that case using single quotes around your $term variable is incorrect but won't cause an error on MySQL servers. Especially because you are new to PHP, I would recommend to do some reading about making PHP secure, your code above has lots of possibilies for code injection and SQL injection: * Escaping variables for use in MySQL queries [1] * SQL Injection [2] * PHP and security [3] Best regards, Sascha [1] http://de.php.net/mysql_real_escape_string [2] http://de.php.net/manual/en/security.database.sql-injection.php [3] http://de.php.net/manual/en/security.php -- Freundliche Grüße / Kind regards, Sascha Meyer -------------------------------------------------- EE: http://www.experts-exchange.com/M_761556.html ZCE: http://www.zend.com/en/yellow-pages#show-ClientCandidateID=ZEND011290 GRATIS! Movie-FLAT mit über 300 Videos. Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome

« previous php.db (#47529) next »