Question

Now before we begin let me inform you all that this is just a school assignment and that I am not overly an expert in php and sql coding.

I have the problem, whenever I execute the script, I receive the following error:

Notice: Undefined variable: Team in
C:\xampp\htdocs\NFL\searchmatches.php on line 30.

From my understanding, there would be a spelling error in the link up between the script and the form file, but I can’t seem to find the problem.

This is a file to search the database:
Script:

 <?php
    mysql_connect("localhost","root","0gd1d0wgpg") or die(mysql_error());
    mysql_select_db("NFL") or die(mysql_error());
    $query=mysql_query("SELECT * FROM Matches where Team ='$Team'") or die(mysql_error());
    $numfields = mysql_num_fields($query);
    print("<table border=\"1\">\n<tr>\n");
    for ($i=0; $i<$numfields; $i++) {
      printf("<th>%s</th>\n", mysql_field_name($query,$i));
    }
    print("</tr>\n");
    while ($row = mysql_fetch_row($query)) {
      print("<tr>\n");
      for ($i=0; $i<sizeof($row); $i++) {
         printf("<td>%s</td>\n", $row[$i]);
      }
      print("</tr>\n");
    }
    print("</table>\n");
    ?>

Form:

<form name="addmatch" method="post" action="searchmatches.php">
Search for the match history of a particular team here.<br>
<br>
Team Name: <input type="text" name="Team_Name" value="Team Name">
<br>
<br>
<input type="submit" value="Search">
</form>

Yes there is more coding in the actual files but I figured that, the PHP would be all you needed to help me.

So could somebody please tell me how rid of this error and make the search work.

Answer 1

PHP uses a special “super global” to give you access to submitted form values. The $_POST superglobal is an array with keys that match the name attribute of the form elements (when the form is submitted with the “post” method). Add this line:

$Team = mysql_real_escape_string($_POST['Team_Name']);

above the use of $Team in the query.

To recap, the ‘Team_Name’ identifier comes from your HTML:

<input type="text" name="Team_Name" value="Team Name">

and then when the form is submitted, whatever you put in that form control is available at $_POST['Team_Name']. I passed the value through the “escape” function so to protect your query from going bonkers (or worse) if that value happened to contain special characters.