0

I'm trying to use the following code to make a search on my website in the database, the goal is to return all columns in multiple tables that contain the search including the parent-table which I have included in as a column in the tables.

$schema = 'maps';
$search = '%'.$_GET["ident"].'%';

$query1 = "
    select TABLE_NAME
    from information_schema.tables
    where TABLE_SCHEMA = '{$schema}'";

$result1 = mysql_query($query1);
$queryParts = array();
while($row = mysql_fetch_assoc($result1)) {
    $table = $row['TABLE_NAME'];
    $queryPart = "
    select name, isin, parent
    from `maps`.`{$table}`
        where `isin` like '{$search}'
    ";
    $queryParts[] = $queryPart;
}
$unionQuery = implode(' union all ', $queryParts);

$result2 = mysql_query($unionQuery);

and echo using:

while($row = mysql_fetch_array($result2))
                        {
                            $f1 = $row['name'];
                            $f2 = $row['parent'];
}

I get the following error

mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\home\security.php on line 55

Cœur
  • 37,241
  • 25
  • 195
  • 267
Felix Eklöf
  • 3,253
  • 2
  • 10
  • 27
  • 1
    You are also vulnerable to [sql injection attacks](http://bobby-tables.com) – Marc B Oct 31 '16 at 17:08
  • **WARNING**: If you're just learning PHP, please, do not use the [`mysql_query`](http://php.net/manual/en/function.mysql-query.php) interface. It’s so awful and dangerous that it was removed in PHP 7. A replacement like [PDO is not hard to learn](http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/) and a guide like [PHP The Right Way](http://www.phptherightway.com/) explains best practices. Your user parameters are **not** [properly escaped](http://bobby-tables.com/php) and there are [SQL injection bugs](http://bobby-tables.com/) that can be exploited. – tadman Oct 31 '16 at 18:12
  • Thanks for the warning, I've started implementing PDO now, can I use the some query but call them with PDO? Or are the queries themself unsafe? Thanks. – Felix Eklöf Nov 04 '16 at 15:45

0 Answers0