2

Still in the learning process of mysql and php. I have a mysql database with 1 table. I simply want a search box that the user can input a company name (Best Buy for example) and then it will output a list of the products bought at Best Buy with price and all that stuff from the database. EDIT: The ERROR im receiving is "Query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Resource id #3' at line 1 Resource id #3 "

<html>
    <head>
        <title>Search the Database</title>
    </head>
    <body>
    <form action="index.php" method="post">
     Search: <input type="text" name="vendor" /><br />
    <input type="submit" name="submit" value="Submit" />
    </form>
    </body>
</html>

<?php
$mysql_host = 'localhost';  
$mysql_user = 'user_name';  
$mysql_pass = '12345';  
$Name = "user_db";
$Table = "table1";
mysql_connect ($mysql_host, $mysql_user, $mysql_pass, $Name) or die ('Error connecting to mysql');
mysql_select_db("$Name") or die ("unable to select DB");

      echo $_POST['vendor'];
      $vendor2 = $_POST['vendor'];
      $sqlquery = mysql_query("Select * From $Table WHERE `purchases`.`vendorname` LIKE '%$vendor2%';");
      $result = mysql_query($sqlquery) or die('Query failed: ' . mysql_error() . "<br />\n$sqlquery");  ;
      $number = mysql_num_rows($result);
?>

<table cellspacing=0 cellpadding=4 border=1>
<tr>
<th>Vendor</th>
<th>Product</th>
<th>DateOrdered</th>
<th>Cost</th>
</tr>


<?php
for($counter = 0; $counter < mysql_num_rows($result); $counter++) {
?>

<tr>
<td><?php echo mysql_result($result,$counter,"vendorname")?></td>
<td><?php echo mysql_result($result,$counter,"product")?></td>
<td><?php echo mysql_result($result,$counter,"date")?> </td>
<td><?php echo mysql_result($result,$counter,"price1")?> </td>
</tr>

<?php
}
?>

</table>
<?php
?>
drclayton
  • 63
  • 2
  • 10
  • 1
    Better add reading up about [SQL injection attacks](http://bobby-tables.com) to your study plan BEFORE you put this code on a public-facing webserver...otherwise enjoy watching your server get pwn3d remotely. Kudos for actually checking for error conditions and using mysql_error(), however. – Marc B Dec 17 '12 at 21:40
  • There is a good answer http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection to the SQL injection issue. Seriously, this is far more pressing than the original question. – Godeke Dec 17 '12 at 21:58
  • thanks for the heads up - will do – drclayton Dec 18 '12 at 13:11

0 Answers0