调用数据库以检查值是否存在

Question

I'm trying to run a query to check if what is entered into a textfield matches that of what is stored in a database.

The current code:

</form>
<br />
<h2>Discount Code</h2>
<br />
<form method="POST" action=''>
        <input type="text" name="discount" />
        <input type="submit" name="discountSubmit" value="Apply" />

    <?php 
    if(isset($_POST['discountSubmit'])){

    $discountCode = $_POST['discount'];

    $codeCheck = mysqli_query("SELECT code FROM discount WHERE code = $discountCode");

    var_dump($codeCheck);
    }

    ?>
    </form>

However, upon clicking discountSubmit the var_dump returns NULL so it would lead me to assume $codeCheck is wrong, however it looks right to me.

I connect through the database through another page so the issue doesnt lie there

Database Structure:

id        code       discount      expire

---

1         WEB10       10.00      2013-06-01

Expire isn't relevant just at the moment.

Answer 1

Here, code is not an integer value. Hence, enclose it by single quotes. You should also include the $conn (connection variable) while using mysqli_query() statement - mysqli_query()

$codeCheck = mysqli_query($conn, "SELECT code FROM discount WHERE code = '$discountCode'");

[EDIT] If you are including the connection page inside this page, try doing these:

connect.php

function connect(){
   $conn = mysqli_connect($host, $un, $pw, $db);
   return $conn;
}

Now, call this function from the current page and get the connection variable:

$conn = connect();

Now, use $conn for the mysqli_query() function.

---

Change the if condition as follows:

if(isset($_POST['discount']))

Answer 2

1. You shouldn't mix SQL with HTML
2. You shouldn't use a function without reading its manual page first
3. You shouldn't use bare API with mysqli, but some abstraction library instead.

A better version for your code, courtesy of safeMysql which works the natural way you expect from mysqli_query but don't get it.

<?php 
$check = NULL;
if(isset($_POST['discountSubmit']))
{
    $sql   = "SELECT code FROM discount WHERE code = ?i";
    $check = $db->getOne($sql, $_POST['discount']);
}
?>
<h2>Discount Code</h2>
<br />
<form method="POST" action=''>
        <input type="text" name="discount" />
        <input type="submit" name="discountSubmit" value="Apply" />
</form>
<?php var_dump($check); ?>