How to compare $_POST to existing Text in table?

Question

I'm developing a mobile application for android and I'm trying to compare a variable on the phone to a variable already in the database, so that I can insert it if it's new and update it if it already exists.

$name_check = $_POST['Name'];

$result = mysqli_query($con, "SELECT * FROM Data WHERE Name = $name_check");
if($result && mysqli_num_rows($result) > 0)
{
// Update entry
}

This code doesn't seem to work as this block is skipped over and goes to my else block where a new entry is written, so I end up with loads of entries instead of updating one.

I have another field in the table called "Level", and when I compare against that it seems to work, which just confuses me further.

If anyone has any insight into how to do this or why it's not working for me I'd be very grateful.

I'm aware, I'm doing this as a learning exercise. Was just wondering why the comparison wasn't working. — Blocky, Mar 30 '15 at 18:22

score 0 · Accepted Answer · answered Mar 30 '15 at 18:23

0

Use quotes:

$result = mysqli_query($con, "SELECT * FROM Data WHERE Name = '$name_check'");

answered Mar 30 '15 at 18:23

fdglefevre

672
4
15

Thank you very much! I cannot believe how many other things I tried. – Blocky Mar 30 '15 at 18:29
1

I recommend you to protect this field. Watch to MySQL Prepared Statements. – fdglefevre Mar 30 '15 at 18:32
Yeah, that's my next step from here. Thanks for your help. – Blocky Mar 30 '15 at 18:34

score 0 · Answer 2 · edited Mar 31 '15 at 00:07

0

Use this:

$result = mysqli_query($con, "SELECT * FROM Data WHERE Name = '" . $name_check . "'");

edited Mar 31 '15 at 00:07

Undo

25,519
37
106
129

answered Mar 30 '15 at 18:25

Saloni Dhall

86
3

you did not close the opening " before ); – Khan Shahrukh Mar 30 '15 at 18:26
Just forget to end it with double quotes. – Saloni Dhall Mar 30 '15 at 18:42

score 0 · Answer 3 · answered Mar 30 '15 at 18:25

0

$result = mysqli_query($con, "SELECT * FROM Data WHERE Name = '".$name_check."'");

This should work fine

answered Mar 30 '15 at 18:25

Khan Shahrukh

6,109
4
33
43

1

All of the listed answers will work but keep in mind this is a very good case to demonstrate SQL injection. Make sure to sanitize your input values as there could be something malicious put into your form and glean information about your database. Some ways to do this are using data validation before running the insert statement or the use of prepared database statements. – Jason Bell Mar 30 '15 at 18:34

How to compare $_POST to existing Text in table?

3 Answers3