code_junkie

php and sql query failing

Nov 12th, 2011
56
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.88 KB | None | 0 0
  1. <?php
  2. session_start(); //ommit, no session var used
  3.  
  4. //use braces, always!
  5. //you may write such statements with the short form like
  6. if (isset($_GET['cmd'])) : $cmd = $_GET['cmd']; else : die (_MSG_NO_PARAM); endif;
  7.  
  8. $query = '';
  9. //escpae your input - very important for security! sql injection!
  10. if ( isset ($_GET["query"]))
  11. {
  12. $query = mysql_real_escape_string($_GET["query"]);
  13. }
  14. //no need for the other part you had here
  15.  
  16. $con = mysql_connect("localhost", "root", "geheim");
  17.  
  18. if (!$con) : die ('Connection failed. Error: '.mysql_error()); endif;
  19.  
  20. mysql_select_db("ebay", $con);
  21.  
  22. if ($cmd == "GetRecordSet")
  23. {
  24. $table = 'Auctions';
  25. $rows = getRowsByArticleSearch($searchString, $table);
  26.  
  27. //use PHP_EOL instead of n in order to make your script more portable
  28.  
  29. echo "<h1>Table: {$table}</h1>".PHP_EOL;
  30. echo "<table border='1' width='100%'><tr>".PHP_EOL;
  31. echo "<td width='33%'>Seller ID</td>".PHP_EOL;
  32. echo "<td width='33%'>Start Date</td>".PHP_EOL;
  33. echo "<td width='33%'>Description</td>".PHP_EOL;
  34. echo "</tr>n";
  35.  
  36. // printing table rows
  37. foreach ($rows as $row)
  38. {
  39. $pk = $row['ARTICLE_NO'];
  40. echo '<tr>'.PHP_EOL;
  41. echo '<td><a href="#" onclick="GetAuctionData(''.$pk.'')">'.$row['USERNAME'].'</a></td>'.PHP_EOL;
  42. echo '<td><a href="#" onclick="GetAuctionData(''.$pk.'')">'.$row['ACCESSSTARTS'].'</a></td>'.PHP_EOL;
  43. echo '<td><a href="#" onclick="GetAuctionData(''.$pk.'')">'.$row['ARTICLE_NAME'].'</a></td>'.PHP_EOL;
  44. echo '</tr>'.PHP_EOL;
  45. }
  46. }
  47. mysql_free_result($result);
  48. //mysql_close($con); no need to close connection, you better don't
  49.  
  50.  
  51. function getRowsByArticleSearch($searchString, $table)
  52. {
  53. $searchString = mysql_real_escape_string($searchString);
  54. $result = mysql_query("SELECT ARTICLE_NO, USERNAME, ACCESSSTARTS, ARTICLE_NAME FROM {$table} WHERE upper ARTICLE_NAME LIKE '%" . $searchString . "%'");
  55. if($result === false) {
  56. return mysql_error();
  57. }
  58. $rows = array();
  59. while($row = mysql_fetch_assoc($result)) {
  60. $rows[] = $row;
  61. }
  62. return $rows;
  63. }
  64.  
  65. // ?> ommit closing php tag
  66.  
  67. "SELECT ARTICLE_NO, USERNAME, ACCESSSTARTS, ARTICLE_NAME
  68. FROM {$table} WHERE upper ARTICLE_NAME LIKE'%$query%'"
  69.  
  70. "SELECT ARTICLE_NO, USERNAME, ACCESSSTARTS, ARTICLE_NAME
  71. FROM {$table} WHERE upper(ARTICLE_NAME) LIKE'%$query%'"
  72.  
  73. $result = mysql_query($sql_query) or die(mysql_error());
  74.  
  75. function searchQuery($text) {
  76. $text = mysql_real_escape_string($text);
  77. $result = mysql_query("SELECT ARTICLE_NO, USERNAME, ACCESSSTARTS, ARTICLE_NAME FROM {$table} WHERE upper ARTICLE_NAME LIKE '%" . $text . "%'");
  78. if($result === false) {
  79. return mysql_error();
  80. }
  81. $rows = array();
  82. while($row = mysql_fetch_assoc($result)) {
  83. $rows[] = $row;
  84. }
  85. return $rows;
  86. }
  87.  
  88. $result = searchQuery($_GET['query']);
  89. if(!is_array($result) ) {
  90. echo 'An error has occurred:' . $result;
  91. } else {
  92. //iterate over rows
  93. }
Add Comment
Please, Sign In to add comment