How to make this MySQL query using variables to work?

Asked Mar 10 '16 at 00:49

Active Mar 10 '16 at 12:22

Viewed 51 times

I have a form which sends a Roll_No value using post method to a php file:

//Query the database
$resultSet = $mysqli->query("SELECT * FROM late WHERE 'Roll_No' LIKE '" . $_POST['Roll_No'] . "';");

//Count the returned rows
if($resultSet->num_rows != 0){  

//Turn the results into an array and echo them
    while($rows = $resultSet->fetch_assoc())
    {
        $Roll_No = $rows['Roll_No'];
        $Time = $rows['Time'];

        echo "<p>Roll_No: $Roll_No <br />Time: $Time</p>";
    }

My code seems to be unable to take the Roll_No value from the form and therefore gives no results.

EDIT: Here's the form

<form action="report-d1.php" method="post" />
<p>Search by Roll_No<input type="text" name="Roll_No" /></p>
<input type="submit" value="Submit" />
</form>

edited Mar 10 '16 at 12:12

asked Mar 10 '16 at 00:49

Sluppo

stop, putting raw user generated variables in to your query will get you hacked faster than I can say arggggggggggggggggggg – Mar 10 '16 at 00:51
Check first if $_POST isset . – cpugourou Mar 10 '16 at 00:54
.. why LIKE and not **=** – Mar 10 '16 at 00:55
Hi, @Sluppo! Use at least `[*_real_escape_string](http://php.net/manual/en/function.mysql-real-escape-string.php)` and try to use `%` before or after, or both when binding your `Roll_no` variable to your query. And I'm not sure about the `;` inside your query. What is the purpose of that? – Logan Wayne Mar 10 '16 at 00:56
4

sidenote: identifier quotes are backticks – Kevin Mar 10 '16 at 00:58
@Ghost - oh yeah, forgot about that one. Nice observation – Logan Wayne Mar 10 '16 at 00:59
@Dagon How else can I go about doing this then? I only started doing this a week ago, I did not know of PHP or MySQL until then. Also yes I tried using = but that gave the same result so I tried using LIKE afterwards. – Sluppo Mar 10 '16 at 01:18
is your form even using post? – Mar 10 '16 at 01:21
@cpugourou Checked, yes it's set. – Sluppo Mar 10 '16 at 01:24
@Dagon Yes it is, I even checked if $_POST isset and it is. – Sluppo Mar 10 '16 at 01:25
1

add the form to the question – Mar 10 '16 at 01:31
@Dagon For some reason the html code is not getting displayed, even if I limit the code to the

block. – Sluppo Mar 10 '16 at 02:05
@Dagon I'm sorry I tried it now and it worked, was in a hurry to go to college earlier. The form is in the question now. – Sluppo Mar 10 '16 at 12:13
Which type has the Roll_No in your table? – Time to Travel Mar 10 '16 at 12:14
@ManuelBecker It's of the type varchar. – Sluppo Mar 10 '16 at 13:20

How to make this MySQL query using variables to work?

0 Answers0