Question

Ive been trying to crack this for 2 hours, but something is wrong. I am very much used to doing things without mysqli but read that there is a recommended shift towards it from regular mysql commands. Hence am stuck with following:

<?php   
           $mysqli = new mysqli('localhost', 'admin', 'test123', 'kadmindb'); 
            if ($result = $mysqli->query("SELECT * FROM records WHERE '$queryType' = '$keyword'")) {
                while ($row = $result->fetch_object()) {
                    echo "<h2>Result:</h2><br>";
                    echo "ID: " . $row->id . "<br>";                
                    echo "Name: " . $row->cust_name . "<br>";
                    echo "Invoice No: " . $row->invoice_num . "<br>";
                    echo "Date: " . $row->date_recorded . "<br>";   
                }   

            }

        ?>

This code is shown in the page where the result of the query should be displayed but nothing is displayed. I checked that both keyword and queryType variables are set and they contain the correct values. Any help would be greatly appreciated. All am trying to do is: select statement to retrieve all the details based on invoice_num submitted.

EDIT: from help I received, I was able to get this working:

$query = "SELECT * FROM records WHERE ".$queryType. " LIKE  '%$keyword%' ";
                if ($result = $mysqli->query($query)) {
                    while ($row = $result->fetch_object()) {
                        echo "<h2>Result:</h2><br><hr/> "; 
                        echo "ID: " . $row->id . "<br>";                
                        echo "Name: " . $row->cust_name . "<br>";
                        echo "Invoice No: " . $row->invoice_num . "<br>"; 
                        echo "Date: " . $row->date_recorded . "<br>";   
                        echo "<hr/>";
                    }   

                }

Answer 1

Are you sure there’s data to select? This code will only output data if there actually is.

Make sure that $queryType and $keyword are set and have sane values that will yield a result.

Use var_dump($queryType) and var_dump($keyword) immediately before the query. Now check your output. Are they both strings? Run this query directly in PHPMyAdmin and check how many rows you get.

If you can’t do that try echo’ing the number of rows returned along with the query values:

if ($result = $mysqli->query("SELECT * FROM records WHERE $queryType = '$keyword'"))
{
    while ($row = $result->fetch_object())
    {
        echo "<h1>Query WHERE '$queryType' = '$keyword' yielded {$result->num_rows} rows!</h1>";
        echo "<h2>Result:</h2><br>";
    ...

Note, you should not have single quotes around the column ($queryType), if you insist you should use backtick quotes (`) but it’s unnecessary really – if you’re that pedantic you should be using prepared statements.

Also be sure to filter them for any potentially dangerous values that could allow for sql injections. See: mysqli::real_escape_string