sql - php - help me about search to database -
this question has answer here:
i can search in database
warning: mysql_fetch_array() expects parameter 1 resource, boolean given in
my codes
require_once ('.. / config.php'); $ conn = mysql_connect (db_host, db_user, db_password) or die (mysql_error ()); mysql_select_db ("db_database", $ conn); $ search = $ _post ['search']; $ sql = mysql_query ("select * opi model numbers '% $ search%' or name '% $ search%'", $ conn); while ($ row = mysql_fetch_array ($ sql))**strong text** { echo "<tr>"; echo "<td width='60px' height='10px' valign='top' align='left' class='borderdb'>". $ row ['number']. "</ td>"; echo "</ tr>"; }
<?php $conn = mysql_connect (db_host, db_user, db_password) or die (mysql_error ()); mysql_select_db ("db_database", $conn); $search = $_post ['search']; $sql = mysql_query ("select * opi `model numbers` '%$search%' or `name` '%$search%'" ,$conn); while ($row = mysql_fetch_array ($sql)) { echo "<tr>"; echo "<td width='60px' height='10px' valign='top' align='left' class='borderdb'>". $row ['number']. "</ td>"; echo "</ tr>"; } ?> - shouldn't spaces between dollar sign , php variable name.
- if column name has space in it, enclose column names properly
- do not use mysql_* function. they're deprecated , no longer maintained. use mysqli or pdo.
- you're sql statement has sql injection. use mysql_real_escape_string or pdo.
Comments
Post a Comment