php searching function

Question

hello please me out regarding this function . Its searching script. when i am passing integer to it it work and when i pass like 12eh it doesnt work . although i have kept varchar as a datatype so it can work for both

function view($pno)
{
$this->query=("select * from user where pno=$pno");
$rd = $this->executeQuery();
@$data = $rd->fetch_assoc();
return $data; 
}

add single quotes to work for nonintegers. also use something like mysql_real_escape_chars so you dont have an sqlinject — n00b
– n00b, Commented Mar 20, 2011 at 19:00

Treffynnon · Accepted Answer · 2011-03-20 19:00:30Z

3

You need to quote your variable in the SQL query:

$this->query=("select * from user where pno = '$pno'");

Also you would probably do well to do:

$pno = mysql_escape_string($pno);

Before sticking the variable in your SQL statement. The man page explains more.

answered Mar 20, 2011 at 19:00

Treffynnon

21.6k6 gold badges68 silver badges99 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

bensiu · Accepted Answer · 2011-03-20 19:00:24Z

0

$this->query=("select * from user where pno='$pno'");

missing quotes around $pno

answered Mar 20, 2011 at 19:00

bensiu

25.7k56 gold badges81 silver badges117 bronze badges

Comments

YassineB · Accepted Answer · 2011-03-20 19:16:07Z

0

mysql_escape_string() is deprecated in PHP 5.3. Use instead mysql_real_escape_string()

Code will be something like this:

$this->query = "SELECT * FROM user WHERE pno = '" . mysql_real_escape_string($pno) . "'";

answered Mar 20, 2011 at 19:16

YassineB

2212 silver badges7 bronze badges

Collectives™ on Stack Overflow

php searching function

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related