I want to return a specific row in MySQL whose column value is user input from a php form

Question

This is the code I am using. It only returns queries whose value of $isbn does not start with 0.

The rows with isbn value like :09913456 are not returned.

The same query in PhpMyadmin works fine.

$isbn = $_GET["isbn"];
$query = 'SELECT * FROM crossword_data WHERE isbn LIKE '.$isbn;
$result = mysqli_query($con,$query);

while($row = mysqli_fetch_array($result))
  {
    echo $row['title'];
  }      

mysqli_close($con);
?>

Your code is vulnerable to SQL Injection please consider using PDO for data access. — haim770
– haim770, Commented May 12, 2013 at 19:32
What is the field type of the isbn field (varchar / number)? — haim770
– haim770, Commented May 12, 2013 at 19:34
I imagine it should be varchar or char due to the leading zeros. — Dave Chen
– Dave Chen, Commented May 12, 2013 at 19:34
$isbn = "%;--". And now I have your entire table. Sanitize your inputs. — Ayush
– Ayush, Commented May 12, 2013 at 19:35

flaschenpost · Accepted Answer · 2013-05-12 19:55:03Z

1

Please be aware of sql-injection: the user data goes right into your database! escape it. Otherwise everybody could slowdown, read, write or empty your data.

You treat your input like a number, but you mean a string. A number doesn't start with 0.

Solution would be

'SELECT * FROM crossword_data WHERE isbn LIKE "'.$isbn . '"'

edited May 12, 2013 at 19:55

answered May 12, 2013 at 19:35

flaschenpost

2,2352 gold badges15 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Amir · Accepted Answer · 2013-05-12 19:59:15Z

0

$query = 'SELECT * FROM crossword_data WHERE isbn LIKE '.'%".$isbn."%';

answered May 12, 2013 at 19:59

Amir

4,1314 gold badges18 silver badges28 bronze badges

Collectives™ on Stack Overflow

I want to return a specific row in MySQL whose column value is user input from a php form

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related