Replace echo data shown with new echo data when searching

Question

I am creating a page in PHP, HTML and using MySQL. Currently When I load the page, it selects all the data from the staff table and displays it.

I have a search function so the user can filter by first name, last name or full name.

When the user clicks the search button, is it possible to have the data that's showing every row and just to replace it with my searched criteria.

Currently my code is searching correct but its just adding it as a row to all the data rows. I thought i could use a regex to replace but the variable is not accessible globally since it is inside an if statement.

<?php
        $output = NULL;
        if(isset($_POST['submit'])) {


            $regex = '/<table[^>]*>.*?<\/table>/s';  //test doesnt work
            $replace = ''; //test doesnt work
            $result = preg_replace($regex, $replace, $html); //test doesnt work "no html variable"
            echo($result); //test doesnt work

            $search = $con->real_escape_string($_POST['search']);


            $res = $_POST['searchGroup'];   
            if($res == "first") {
                $resultSet = $con->query("SELECT * FROM staff WHERE firstname LIKE '%$search%'");
                if($resultSet->num_rows > 0) {
                    while($rows = $resultSet -> fetch_assoc()) {
                        $field1name = $rows["firstname"];
                        $field2name = $rows["lastname"];
                        $field3name = $rows["dob"];
                        $field4name = $rows["created"];
                        $field5name = $rows["last_updated"];
                        $field6name = $rows["is_user"];


                        $output .= '<tr> 
                                  <td>'.$field1name.'</td> 
                                  <td>'.$field2name.'</td> 
                                  <td>'.$field3name.'</td> 
                                  <td>'.$field4name.'</td> 
                                  <td>'.$field5name.'</td> 
                                  <td>'.$field6name.'</td> 
                              </tr>';

                    }
                }
                else {

                    $output = "No Results";
                }

            }

And then my code which is currently displaying all the data

<?php 
        $query = "SELECT * FROM staff";

        

        echo '<div class="tableFixHead">
        <table border="0" cellspacing="2" cellpadding="2"> 
          <tr> 
              <td> <font face="Arial"><b>First Name</b></font> </td> 
              <td> <font face="Arial"><b>Last Name</b></font> </td> 
              <td> <font face="Arial"><b>Date of Birth</b></font> </td> 
              <td> <font face="Arial"><b>Creation Date</b></font> </td> 
              <td> <font face="Arial"><b>Last Updated</b></font> </td> 
              <td> <font face="Arial"><b>Is User</b></font> </td> 

          </tr>
          </div>';

          echo $output;



        if ($result = $con->query($query)) {
            while ($row = $result->fetch_assoc()) {
                $field1name = $row["firstname"];
                $field2name = $row["lastname"];
                $field3name = $row["dob"];
                $field4name = $row["created"];
                $field5name = $row["last_updated"];
                $field6name = $row["is_user"];


                $html= '<tr> 
                          <td>'.$field1name.'</td> 
                          <td>'.$field2name.'</td> 
                          <td>'.$field3name.'</td> 
                          <td>'.$field4name.'</td> 
                          <td>'.$field5name.'</td> 
                          <td>'.$field6name.'</td> 
                      </tr>';
                echo $html;
            }
            $result->free();
        } 
        ?>

My approach is probably wrong but I was wondering if it is possible to somehow remove that data that is in the current $html echo tag when my search button is pressed.

this colde is **vulnerable** to **sql injection** use only **prepared statements with parameters** see https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — nbk, Dec 02 '20 at 21:52

Motxila dev · Answer 1 · 2020-12-02T23:22:36.417

-1

Besides the code style, vulnerabilities i would like to offer you an example of some sorts. as i presume that you are still a student.

just a simple example what you could do;

$query = "SELECT * FROM staff";
if(isset($_POST['submit'])) {
    $search = $con->real_escape_string($_POST['search']);
    $query .= " WHERE firstname LIKE '%$search%'"
}

This should be sufficient to help you forward.

edited Dec 02 '20 at 23:22

answered Dec 02 '20 at 23:09

Motxila dev

99
5

Replace echo data shown with new echo data when searching

1 Answers1