Hi i was trying to connect MySQL database to a simple html code given below.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org
/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
<form action="result.php" method="POST">
S.No :
<input type="text" name="key">
<input type="submit" value="Search">
</form>
</body>
</html>
This html code passes the form input "key" to another php file whose code is given below.
<?php
$serial=$POST['key'];
if(!$serial){
echo 'Please go back and enter the correct value';
exit;
}
$db = new mysqli('localhost', 'root', '', 'demo_db', 'tbldem');
if(mysqli_connect_errno()) {
echo 'Connection lost.. please try again later !!';
exit;
}
$query = "select * from tbldem where".$serial."like'%".$serial."%'" ;
$result = $db->query($query);
$num = $result->num_rows;
for($i = 0; $i < $num; $i++) {
$row = $result->fetch_assoc();
echo"<p>Serial : </p>";
echo $row['Index'];
echo"<p>Name : </p>";
echo $row['Name'];
echo "<p>Course : </p>";
echo $row['Course'];
}
$result->free();
$db->close();
?>
Now when I try to pass a value in the form input in the my browser I get a php code as a result instead of the information in the database which was supposed to to be returned while passing the value in form input, which is also given below(the problem). I am trying to make a project which use this feature as a primary tool so please help as soon as possible.
query($query); $num = $result->num_rows;
for($i = 0; $i < $num; $i++) {
$row = result->fetch_assoc(); echo"
Serial :
"; echo $row['Index']; echo"
Name :
"; echo $row['Name']; echo "
Course :
"; echo $row['Course']; } $result->free(); $db->close(); ?>
"select * from tbldem where".$serial."like'%".$serial."%'". 1. Open to SQL injection. 2. You are using the same posted value for both the column name and value. 3. There are no spaces betweenwhere,$serial, andlikeso they will all become 1 word ->wherecolumnlike'%column%'.