View difference between Paste ID: kwbtatNk and 0dTLDFxH

 <?php
 $database_host = "localhost";
 $database_username = "fbs";
 $database_password = "";
 $database_name = "my_fbs";
 mysql_connect($database_host,$database_username,$database_password) or die (mysql_error());
 mysql_select_db($database_name) or die (mysql_error());
 
 if(isset($_POST['search']))
 {
-$key = $_POST['key'];
+$key = htmlentities($_POST['key']);
-$search_query = "select * from city where Name like '%$key%'";
+$search_query = "select * from city
-$query = mysql_query($search_query) or die (mysql_error());
+where
 `Name` like '%$key%'";
 $query = mysql_query($search_query) or die (mysql_error()."<b>$search_query</b>" );
 while($row = mysql_fetch_array($query))
 {
 echo "
 name: {$row['Name']}<br>
 country code: {$row['CountryCode']}<br>
 district: {$row['District']}<br>
 population: {$row['Population']}<br>
 ";
 }
 }
 ?>
 
 
 <form action="<?php echo $_SERVER['php_self'] ?>" method="post">
 Name:<br><input type="text" name="key"><br />
 <br><input type="submit" name="search" value="Search">
 
 </form>