PHP variable in MySQL [ Select OR ] Statement not executing

Question

i'm coding a search engine i wrote a form with text input and a button :-

<form class="form-inline my-2 my-lg-0" action="" method="post" name="SearchEngine" enctype="multipart/form-data">
        <div class="form-group">
      <input class="form-control mr-sm-2" name="searchinput" type="search" placeholder="البحث" aria-label="Search">
      </div>
      <div class="form-group">
      <button class="btn btn-outline-Dark my-2 my-sm-0" type="submit" style="direction:RTL;">إبحث</button>
      </div>
    </form>

the back end side [ php code ]

require_once '..\Config.php';

$searchon = $_POST['searchinput'];
$dbCon = "mysql:host=$host;dbname=$db_name";

$PDOCon = new PDO($dbCon, $username, $password);

$stmt = $PDOCon->prepare("SELECT * FROM items WHERE name='$searchon' OR chemicalcom= '$searchon'");
$stmt->execute(); 
$rows = $stmt->fetchall();

echo $rows['name'];

the problem is when is submit a value into the text nothing is echoing

You should change to **prepared statements** https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php and also add errror handling to your code — nbk, Apr 06 '20 at 23:13
An update to @nbk comment, you should change your prepared statement to use parameters. — user3783243, Apr 06 '20 at 23:16
`$rows` is a multidimensional array, if the query worked. You can't echo that. — user3783243, Apr 06 '20 at 23:16
@nbk i don't want mysite to be vulnerable so tell me can i accomplish this query with PDO or not ? — MrObscure, Apr 06 '20 at 23:23

Nadim Al Abdou · Accepted Answer · 2020-04-06T23:25:39.933

-1

// to get the EXCEPTIONS
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

try{
  $stmt = $dbh->prepare("SELECT * FROM items WHERE name=:name OR chemicalcom= :chemicalcom");
$stmt->bindParam(':name', $searchon);
$stmt->bindParam(':chemicalcom', $searchon);
$stmt->execute(); 
$rows = $stmt->fetchAll(); // not fetchall && fetchAll you will get an array so you need to loop over it to get the values like

   foreach($rows as $r){
     echo $r['name'];
    }
 } catch (PDOException $ex) {
    echo  $ex->getMessage();
  }

edited Apr 06 '20 at 23:25

answered Apr 06 '20 at 23:20

Nadim Al Abdou

768
7
13

2

Don't quote placeholders. Also functions aren't case sensitive so `fetchall` and `fetchAll` are the same – user3783243 Apr 06 '20 at 23:25
this is more than explained thanks allot Nadim .. :) – MrObscure Apr 06 '20 at 23:30

PHP variable in MySQL [ Select OR ] Statement not executing

1 Answers1