0

$(document).ready(function() {
  $("#name").autocomplete({
    source: 'search.php',
    minLength: 1
  });
});

<form action='' method='get'>
  <p>
    <label>Country:</label>
    <input type='text' name='name' id="name" class='auto'>
  </p>
</form>

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"></script>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.18/jquery-ui.min.js"></script>
<link rel="stylesheet" type="text/css" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/base/jquery-ui.css" />

Php Code

<?php
include'../connect.php';
$term=$_GET['name'];
print_r($_GET);
$query="SELECT `studentid`,`studentname` FROM student where `studentname` like '%".$term."%' order by studentname ";
print_r($query);
$result=mysqli_query($link,$query);
$json=array();
while($student=mysqli_fetch_assoc($result)){
  print_r($student);
  $json[]=array(
    'value'=> $student['studentid'],
    'label'=>$student['studentname']." - ".$student['studentid']
  );
}
echo json_encode($json);
?>
mplungjan
  • 169,008
  • 28
  • 173
  • 236
Maulik Agarwal
  • 1
  • [Little Bobby](http://bobby-tables.com/) says **[you may be at risk for SQL Injection Attacks](https://stackoverflow.com/q/60174/)**. Learn about [Prepared Statements](https://en.wikipedia.org/wiki/Prepared_statement) with [parameterized queries](https://stackoverflow.com/a/4712113/5827005). I recommend `PDO`, which I [wrote a class for](https://github.com/GrumpyCrouton/GrumpyPDO) to make it extremely easy, clean, and more secure than using non-parameterized queries. Also, [This article](https://phpdelusions.net/pdo/mysqli_comparison) may help you choose between `MySQLi` and `PDO` – GrumpyCrouton May 21 '18 at 18:53
  • If someone typed in `Robert'); DROP TABLE student;--` into your Country input box, you would lose your entire student table. This damage can be multiplied considering if the attacker knew any other table names, they could easily delete those too if the user you are logged into through `mysqli_*` has permissions for said table, which is often the case. I've even seen people attack websites like this using a bot that has programmed hundreds of common table names to attempt to drop in cases like this. – GrumpyCrouton May 21 '18 at 18:54

0 Answers0