在最小值和最大值之间mysqli

Question

I have to create a PHP web page with two text fields in which the user can enter minimum and maximum item prices from a SQL database. So I have items with prices. For example, if a user wants to see items between the prices 4 and 15, he can submit it and then it will show only the items in that price range. How can I do this? How to echo this?

Thank you!

I have this so far:

$min=$_POST["minimum"];

$max=&$_POST["maximum"];

$result = mysqli_query($con,"SELECT * FROM items WHERE selling price BETWEEN {$min}+1 AND {$max}");

Answer 1

Apart from a major SQL Injection issue, your script is looking fine. Just some small typs and syntax errors. Compare this one to yours:

$min=(int)$_POST["minimum"];
$max=(int)$_POST["maximum"];

$result = mysqli_query($con,"SELECT * FROM items WHERE selling_price BETWEEN {$min}+1 AND {$max}");

So, what did I change?

• At least cast posted values to int to remove the chance of anyone injecting malicious SQL code into your query. You should use proper escaping in the future
• You dont need to add the & character before in line two. You dont need to assign the value by reference. just assign the plain old way
• column and table names can not conain spaces in MySQL. Are you sure that is the correct name of the column? Maybe there was an underscore?

Answer 2

One of the many safer and simpler ways of doing that would be

$dsn = "mysql:dbname=test;host=127.0.0.1";
$dbh = new PDO($dsn, 'username', 'password');


if(isset($_POST["minimum"]) && isset($_POST["maximum"]))
{
 $min=floatval($_POST["minimum"]);    //+1 is not needed
 $max=floatval($_POST["maximum"]);

 $sth = $dbh->prepare("SELECT * FROM items WHERE selling_price BETWEEN ? AND ?");
 $sth->execute(array($min,$max));
 while($row = $sth->fetch(PDO::FETCH_OBJ))
 {
    print_r($row);
 }
}

Answer 3

That should do the trick for you:

 if(isset($_POST['minimum'])){

        $min = $_POST['minimum'];
    }else{
        $min = '';
    }

    if(isset($_POST['maximum'])){

        $max = $_POST['maximum'];
    }else{
        $max = '';
    }

    $sql = "SELECT * FROM item WHERE selling_brice > '$min' AND  selling_price < '$max'";
    $query = mysqli_query($con, $sql);
    $count = mysqli_num_rows($query);

    if($query == true && $count > 0 ){

        while ($row = mysqli_fetch_assoc($query)){

            $price .= $row['selling_price'];

            $price .= '<br />'

        }

        echo $price;

    }else{
  echo "NO results to Display";
}

Ofcourse this is not the best programing mysql injections, your query uses * etc....but this should work.