MYSQL Search - PHP Form

Question

<div class="searchbox">
    <form action="Search.php" method="get">
       <fieldset>
          <input id="$search" placeholder="Search for a Product" type="text" />
          <input id="submit" type="hidden" />
       </fieldset>
    </form>
</div>
<div id="content">
<ul>        
<?php

$host = "xxx"; 
$user = "xxx"; 
$pass = "xxx"; 
$db = "xxx"; 

mysql_connect($host, $user, $pass); 
mysql_select_db($db); 
unset($host,$user,$pass,$db); 


//$query = "SELECT produkt FROM checklist WHERE id IS "1";  
$query = "SELECT produkt FROM checklist WHERE id LIKE '%$search%'";  
$result = mysql_query($query); 
  while ($row = mysql_fetch_array($result)) 
{ 

echo "<li><span class='name'><b>$row[produkt]</b><br /></span><span class='comment'><i>Tierische Stoffe: </i>$row[tierisch]</span><i> Alkohol: </i>$row[alkohol]</span></span></li>";
  }  
?>

Something seems to be wrong with my searchbox. At the moment I just see all items from my database and I want to see the one I am searching for.

So like this ?

<div class="searchbox">
    <form action="Search.php" method="get">
       <fieldset>
          <input id="search" placeholder="Search for a Product" type="text" />
          <input id="submit" type="hidden" />
       </fieldset>
    </form>
</div>
<div id="content">
<ul>        
<?php

$host = "xxx"; 
$user = "xxx"; 
$pass = "xxx"; 
$db = "xxx"; 

mysql_connect($host, $user, $pass); 
mysql_select_db($db); 
unset($host,$user,$pass,$db); 

$search = $_POST['search'];

$query = "SELECT produkt FROM checklist WHERE id LIKE '%".$_POST['search']."%'";
//$query = "SELECT produkt FROM checklist WHERE id LIKE '%$search%'";  
$result = mysql_query($query);

can you put oyu database schema ? because you use id in your where condition, don't want to search with the name of product or something else ? :) — Awea
– Awea, Commented Aug 2, 2011 at 14:35

Jonno_FTW · Accepted Answer · 2011-08-02 15:28:58Z

2

<input id="$search" placeholder

Do you need the $ here ? It should become:

<input id="search" placeholder

To access the GET variables from inside your search query use the $_GET array, like this:

$query = "SELECT produkt FROM checklist WHERE id LIKE '%{$_GET['search']}%'";

But to be on the safe side and avoid mysql injections, you may want to do it like this:

$search = mysql_real_escape_string($_GET['search']);
$query = "SELECT produkt FROM checklist WHERE id LIKE '%{$search}%'";

Edit: forgot the name attribute n the input:

<input name="search" id="search" placeholder="Search for a Product" type="text" />

then in your php

$search = mysql_real_escape_string($_GET['search']);
$query = "SELECT produkt FROM checklist WHERE id LIKE '%{$search}%'";

$result = mysql_query($query); 
while ($row = mysql_fetch_array($result)){  
    echo "<li><span class='name'><b>{$row['produkt']}</b></span></li>";
}

edited Aug 2, 2011 at 15:28

answered Aug 2, 2011 at 14:40

Jonno_FTW

8,8297 gold badges60 silver badges91 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

smirk Over a year ago

So it should look like the 2. one?

Jonno_FTW Over a year ago

@smirk, you specified GET in your search form, you need to use the $_GET array as in my solution. I also suggest you use my version to prevent SQL injection attacks.

Jonno_FTW Over a year ago

Ok, just use the last 2 lines of my code. Where I assign the cleaned search term to $search, then use $saerch in the query.

smirk Over a year ago

i just uploaded the files to fskonferenz.de/fabian.rar maybe you could have a look at it -.-

Jonno_FTW Over a year ago

Looks like you forgot to set the name of the inupt field, I have updated my answer with your fixed up code

Jason Kaczmarsky · Accepted Answer · 2011-08-02 14:34:30Z

1

This:

 <input id="$search" placeholder="Search for a Product" type="text" />

Should be (no $ in ID):

<input id="search" placeholder="Search for a Product" type="text" />

And your query should be:

$query = "SELECT produkt FROM checklist WHERE id LIKE '%".$_POST['search']."%'";

Variables from forms get passed to the script(in this case it's the same page), so you have to retrieve them with $_POST.

answered Aug 2, 2011 at 14:34

Jason Kaczmarsky

1,6861 gold badge18 silver badges30 bronze badges

4 Comments

smirk Over a year ago

So it should look like the 2. one?

Jason Kaczmarsky Over a year ago

Yes it should. You don't need a $.

Jason Kaczmarsky Over a year ago

Also, you need to change method="get" to method="post" in your form.

Jonno_FTW Over a year ago

It's not necessary, it's just another way of submitting data. Although convention is to use POST in this type of case.

George Cummins · Accepted Answer · 2011-08-02 14:47:36Z

0

You did not set the value of $search. You need to update your form to include an element with name="search" and add a line of PHP like the following just before the query:

$search = $_GET['search'];

You will also want to escape the input to avoid SQL injection.

edited Aug 2, 2011 at 14:47

answered Aug 2, 2011 at 14:34

George Cummins

29k8 gold badges74 silver badges91 bronze badges

7 Comments

smirk Over a year ago

So it should look like the 2. one?

George Cummins Over a year ago

@smirk, as noted by Jonno_FTW, your form uses GET so I update my answer. You will need to update your second code listing to use the line I posted above. Then change your query back to the way it was before (using the $search variable.

smirk Over a year ago

So like this ? $search = $_GET['search']; $query = "SELECT produkt FROM checklist WHERE id LIKE '%".$_GET['search']."%'";

smirk Over a year ago

George Cummins Over a year ago

First part is correct. The second part should be: $query = "SELECT produkt FROM checklist WHERE id LIKE '%$search%'"

|

Collectives™ on Stack Overflow

MYSQL Search - PHP Form

3 Answers 3

5 Comments

4 Comments

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

4 Comments

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related