Incorrect Php-SQL output from index.php

Question

I have a index.php file with a simple form and it is submitting those values from that form to a searchAction.php file. However, the output after pressing search from index page is different and not correct than the search button pressed on searchAction.php even though both executing same php for searchAction.

    <?php
        //Start session
        session_start();    
        //Unset the variables stored in session
        unset($_SESSION['search']);
    ?>
 <html lang="en">

  <body>  

    <form id="searchbox" method="POST" action="searchAction.php">
        <select id= "selectType" name="combo">
            <option class="defualt-text">--Select Search Type--</option>
            <option value="0">ALL</option>
            <option value="1">Shopname</option>
            <option value="2">Shop Category</option>
            <option value="3">Product Name</option>
            <option value="4">Product Category</option>
        </select>
        <input id="search" type="text" placeholder="Search..." name="search">
        <input id="submit" type="submit" value="Search" name="submit">
    </form>
                <?php
                    if( isset($_SESSION['ERRMSG_ARR']) && is_array($_SESSION['ERRMSG_ARR']) && count($_SESSION['ERRMSG_ARR']) >0 ) {
                        echo '$_SESSION["ERRMSG_ARR"]';
                        unset($_SESSION['ERRMSG_ARR']);
                    }
                ?>
    </body>

</html>

For SearchAction.php

    <?php 
        $button = $_POST ['submit'];
        $search = $_POST ['search'];
        $option = $_POST ['combo'];
    ?>
<div id="top">

    <div id="topsbar">
        <form method="POST" action="searchAction.php">

            <input id="topsearch" type="text" name="search">
            <input id="topsubmit" type="submit" name="submit">
        </form>
    </div>
</div>

<hr size='1'>
<?php
    mysql_connect("localhost","root","root");
    mysql_select_db("db_tech");

    switch($option){

        case 0: $sql = "SELECT S.SHOPNAME, P.PRODUCTNAME,S.SHOPURL FROM sNameSearch S JOIN pNameSearch P ON S.SHOPID = P.SHOPID WHERE S.SHOPNAME LIKE '%".$search."%' ORDER BY S.SHOPNAME";
                break;
        case 1: $sql = "SELECT SHOPNAME,SHOPCAT,SHOPURL FROM sNameSearch WHERE SHOPNAME LIKE '%".$search."%' ORDER BY SHOPNAME";
                break;
        case 2: $sql = "SELECT SHOPNAME,SHOPCAT,SHOPURL FROM sNameSearch WHERE SHOPCAT LIKE '%".$search."%' ORDER BY SHOPCAT";
                break;

}

$run = mysql_query($sql);
$foundnum = mysql_num_rows($run);
echo $foundnum;
?>

[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Jan 27 '16 at 20:02
Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Jan 27 '16 at 20:02
your second form (in SearchAction.php) lacks the 'combo' parameter. so if you think that second form produces correct result, while the first one doesn't, perhaps check this parameter for both cases (just dump it before switch) — Oleg Shemetov, Jan 27 '16 at 20:11
@devpro, the default is set for case 1. So it will execute there. — Grim42, Jan 28 '16 at 02:30
@Oleg, The combo is the combo box in index.php. I ommitted that part of the code as its not relevant to my problem. The main problem is if I am executing index.php ans searching, the output is not correct. But its correct when searchAction.php is running. Please see my project, http://mall.simpligrab.com .Simply input Nature and it will show 3 entries and no reaching searchAction.php, and pressing search again, it will show the correct entry. I need to correct that. — Grim42, Jan 28 '16 at 02:36
combo tells it which sql statement to run, how could it not be relevant? `$option = $_POST ['combo'];` then `switch($option){` without a value sent in 'combo' you probably get no results since $sql will be empty — Joe T, Jan 28 '16 at 03:42
@Grim42 consider dumping your parameters, both on script entry, where you assign them and directly before running a query. compare these for both scripts you're running. dump the query too, compare it for your valid and invalid results. — Oleg Shemetov, Jan 28 '16 at 06:43
@Grim42: when i check from index.php it return this SELECT SHOPNAME,SHOPCAT,SHOPURL FROM sNameSearch WHERE SHOPNAME LIKE '%test%' ORDER BY SHOPNAME — devpro, Jan 28 '16 at 07:20
@Grim42: and when i check test keyword from SearchAction.php it returns SELECT S.SHOPNAME, P.PRODUCTNAME,S.SHOPURL FROM sNameSearch S JOIN pNameSearch P ON S.SHOPID = P.SHOPID WHERE S.SHOPNAME LIKE '%test%' ORDER BY S.SHOPNAME — devpro, Jan 28 '16 at 07:20
@Grim42: now run both queries and check the result in phpmyadmin — devpro, Jan 28 '16 at 07:21

Incorrect Php-SQL output from index.php

0 Answers0