Question

I’m a real newbie with php and MySQL. Now I’m working on the following code which should search the database for eg. all the Lennons living in Liverpool.

1) How should I modify “get.php” to get the text “no results” to appear if there are no search results.

2) How should I modify “index.php” to get the option values (city and lastname) straight from the database instead of having to type them one by one?

3) Am I using mysql_real_escape_string the right way?

4) Any other mistakes in the code?

index.php:

<form action="get.php" method="post">
    <p>
        <select name="city">
            <option value="Birmingham">Birmingham</option>
            <option value="Liverpool">Liverpool</option>
            <option value="London">London</option>
        </select>
    </p>
    <p>
        <select name="lastname">
            <option value="Lennon">Lennon</option>
            <option value="McCartney">McCartney</option>
            <option value="Osbourne">Osbourne</option>
        </select>
    </p>
    <p>
        <input value="Search" type="submit">
    </p>
</form>

get.php:

<?php
$city = $_POST['city'];
$lastname = $_POST['lastname'];

$conn = mysql_connect('localhost', 'user', 'password');
mysql_select_db("database", $conn) or die("connection failed");
$query = "SELECT * FROM users WHERE city = '$city' AND lastname = '$lastname'";
$result = mysql_query($query, $conn);

$city = mysql_real_escape_string($_POST['city']);
$lastname = mysql_real_escape_string($_POST['lastname']);

echo $rowcount;
while ($row = mysql_fetch_row($result)) 
{
    if ($rowcount == '0') 
        echo 'no results';
    else
    {
        echo '<b>City: </b>'.htmlspecialchars($row[0]).'<br />';
        echo '<b>Last name: </b>'.htmlspecialchars($row[1]).'<br />';
        echo '<b>Information: </b>'.htmlspecialchars($row[2]);
    }
}

mysql_close($conn);
?>

Answer 1

1) the $rowcount variable is not defined. Do something like this instead:

$zerorows=true;
while ($row = mysql_fetch_row($result)) 
{
  $zerorows=false;
  echo '<b>City: </b>'.htmlspecialchars($row[0]).'<br />';
  echo '<b>Last name: </b>'.htmlspecialchars($row[1]).'<br />';
  echo '<b>Information: </b>'.htmlspecialchars($row[2]);
}
if($zerorows) echo "no results";

2) Select them from the db and write them in the HTML

<select><?php
$q=mysql_query(...);
while($row=mysql_fetch_row($q))
echo "<option>".$row[0]."</option>";
?></select>

3) You have to use the function before the query:

$query = "SELECT * FROM users WHERE city = '".mysql_real_escape_string($_POST['city'])."' AND lastname = '".mysql_real_escape_string($_POST['lastname'])."'";

4) Try the code. It’s hard to find errors without testing.