Trying to make a search bar with a MINI PHP MVC

Question

I am trying to make a search bar for my application.

I am using the following Mini Framework: https://github.com/panique/mini

What I want to do is have an input field where you type an username, and then a table is displayed underneath with all the information from the Database.

Environment:

PHP 7.4
Apache
CentOS 8
SQL Server 2019

My problem is, I don't know how to pass the input value to the controller and then to the model.

Let me show you what I have tried:

Account Model:

public function getUser($name)
{
    
    $sql = "SELECT * FROM dbo.user_table WHERE Name = :name ORDER BY UserID DESC";
    $query = $this->db->prepare($sql);
    $query->execute(array(':name' => $name));

    return $query->fetchAll();
}

Account Controller:

/**
 * ACTION: getUser
 */
public function getUser()
{       
    if(isset($_POST['search_user'])) {
        $checkUser = $this->model->getUser($_POST['username']);
    }
}

My View:

<form action="<?php echo URL; ?>account/getUser" method="POST" class="mb20">
        <div class="row">                  
            <div class="input-wrap col-sm-12">
                <input type="text" placeholder="Type username" name="username" autocomplete="off" />
            </div>                                      
        </div></br> 
        <input type="submit" value="Search" name="search_user" />
    </form>

I am not sure how to echo the result in the view. Maybe someone here could guide me in the correct direction.

Thanks!

score 1 · Answer 1 · answered Feb 02 '21 at 20:39

Account Controller:

/**
 * ACTION: getUser
 */
public function search()
{       
    if(isset($_POST['search_user'])) {
        $checkUser = $this->model->getUser($_POST['username']);
    }
    require APP . 'view/search/index.php'; // your search view path

}

Search View:

<form action="<?php echo URL; ?>search" method="POST" class="mb20">
  <div class="row">                  
      <div class="input-wrap col-sm-12">
          <input type="text" placeholder="Type username" name="username" autocomplete="off" />
      </div>                                      
  </div></br> 
  <input type="submit" value="Search" name="search_user" />
</form> 

<?php

if (isset($checkUser)) {
  echo '<ul>';
  foreach ($checkUser as $key => $value) {
    echo '<li>';
    echo $value->name;
    echo '</li>';
  }
  echo '</ul>';
}

In this way, if there's the $_POST['search_user'], the function search will perform the search and put the result on the $checkUser variable. The variable will be still present on the View because you're requiring it after the $checkUser declaration. Then, the View checks if the variable is present and displays the results.

IMPORTANT

The line echo $value->name; is a dangerous behavior, because it can allow XSS, so, before rendering anything from the database, remember to escape it properly. Some ways to do it:

How to prevent XSS with HTML/PHP?

https://www.php.net/manual/pt_BR/function.strip-tags.php

Trying to make a search bar with a MINI PHP MVC

1 Answers1