how to use multiple HTML text inputs to make an SQL search query

Question

I have a form that contains multiple html text inputs, and I'd like to use the values of these inputs to make one search query (for example I want it to look like this results.php?input=value1+value2+value3) I've tried, however I haven't managed to get one that queries with all the values from the 3 input fields.

$input = $_GET['input']; //this is for the text input - ignore
$topic = $_GET['topic']; // the first select box value which works well
$location = $_GET['location']; //the second select box value which isn't being inserted into the query
$combined = $input . $topic . $location;
$terms = explode(" ", $combined);
$query = "SELECT * FROM search WHERE input='$input' AND topic ='$topic' AND location='$location' ";'

Writing a query with one input field is easy. adding more is even easier: add more form fields, get their data into PHP, then use and and/or or in your query to chain the individual field clauses together in your where clause. But that's up to you to do. We're not here to teach you what is essentially basic PHP and SQL. — Marc B
– Marc B, Commented Jul 8, 2014 at 22:09
Please show us the code that you tried. If you don't show us what you've already done and tell us specifically where you're having trouble, we can't help. — Jashaszun
– Jashaszun, Commented Jul 8, 2014 at 22:10
Print the values of all variables please. Your code is also vulnerable to an SQL injection attack. You should use MySQLi. — Matt3o12
– Matt3o12, Commented Jul 8, 2014 at 22:23

Samsquanch · Accepted Answer · 2014-07-08 22:25:14Z

1

You can do it the way you've shown, but you should really be using built in PHP functions for escaping input via prepared statements, for example with mysqli's bind_param:

$db = new mysqli(*your database connection information here*);
$input = $_GET['input']; //this is for the text input - ignore
$topic = $_GET['topic']; // the first select box value which works well
$location = $_GET['location']; //the second select box value which isn't being inserted into the query
$combined = $input . $topic . $location;
$terms = explode(" ", $combined);
$stmt = $db->prepare("SELECT * FROM search WHERE input = ? AND topic = ? AND location = ?");
$stmt->bind_param("sss", $input, $topic, $location);
$stmt->execute();
$stmt->close();

As for the form to get the URL you're wanting:

<form action="results.php" method="GET">
  <input type="text" name="input">
  <input type="text" name="topic">
  <input type="text" name="location">
</form>

The action is set to your results.php script, and the method is set to GET in order to have the form inputs put in the URL.

answered Jul 8, 2014 at 22:25

Samsquanch

9,17612 gold badges55 silver badges90 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user2379090 Over a year ago

Thank you so much for explaining it very well! I really appreciate you taking time to write all this. I just implemented this into my code and got this error: Fatal error: Call to a member function bind_param() on a non-object in /customers/c/8/c/adamallard.info/httpd.www/ta/results.php on line 150 line 150 being '$stmt->bind_param("sss", $input, $topic, $location); '

Samsquanch Over a year ago

That usually happens if the $db->prepare portion returns false. If it is returning false, check your table name and column names to make sure they exist and are spelled right in the select statement. That is usually the most common culprit.

user2379090 Over a year ago

Hate to bother you again, but now I'm getting this error: 'Call to a member function bind_param() on a non-object'

Collectives™ on Stack Overflow

how to use multiple HTML text inputs to make an SQL search query

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related