使用PHP表单中的2个字段来从MySQL数据库中检索信息

Question

I have a MySQL database with 3 columns:

id  |  articletitle  | articleorganization

And a simple PHP form with 2 fields and a submit button: search.php

<div class="content">
    <form id="form1" name="form1" method="post" action="searchdb.php">
    <table width="100%" border="0" cellpadding="6">
    <tr>
      <td width="29%" align="right">Article Title:</td>
      <td width="71%" align="left"><input name="title" type="text" id="articletitle" size="50" /></td>
    </tr>
    <tr>
      <td align="right">Author or Organization:</td>
      <td align="left"><input name="organization" type="text" id="articleorganization" size="50" /></td>
    </tr>
      </table>


    <table width="100%" border="0" cellpadding="6">
      <tr>
        <td><input type="submit" name="submit" value="Submit" /></td>
        </tr>
    </table>
    </form>
</div>

The form connects to searchdb.php:

<?php

include('settings.php');

$title = mysql_real_escape_string($_POST['title']);
$organization = mysql_real_escape_string($_POST['organization']);

$sql = "SELECT * FROM articles WHERE 1 "
     . (isset($title) ? "AND articletitle LIKE '$title%' " : "")
     . (isset($organization) ? "AND articleorganization LIKE '$organization%'" : "");

while ($row = mysql_query($sql)){
    echo '<br/> Article Title: '.$row['articletitle'];
    echo '<br/> Article Organization: '.$row['articleorganization'];
    echo '<td><a href="edit.php?id=' . $row['id'] . '">Edit</a></td>';
    echo '<td><a href="delete.php?id=' . $row['id'] . '">Delete</a></td>';
    echo '<td><a href="entry.php?id=' . $row['id'] . '">View Full Entry</a></td>';
    echo '<br/><br/>';
    }

?>

After some revision with the help of commenters the problem has changed.

Now, upon submitting a search, the results page begins scrolling the table that is created via searchdb.php over and over again, though without any results in the table.

Answer 1

Basically, when you have several items with the same name referencing some kind of array what you get is an actual array afterwards.

That is to say that if the input boxes are filled with "a" and "b" the variable $_POST['term'] will be equal to array("a", "b") .

With regards to indenting, it is part of your code style, do it whatever way you feel comfortable with as long as you are consistent across your whole code base.

Edit : I do agree with others that you should be a lot more careful with user input and how you add that data to your queries

Answer 2

If you echo your query, it will print something like this:

select * from articles where articletitle like '%%'

That's why your code returning all rows from the table. To make it work the way you want, change the name of your <input> to match with your columns.

<input type="text" name="title" />
<input type="text" name="organization" />

Given these tags, you'll have $_POST contains array like this:

Array
(
  [title] => 'some value',
  [organization] => 'another value',
)

And you have to perform some logic in your query. If only title is supplied,

SELECT * FROM articles WHERE articletitle LIKE '%$title%'

If only organization is supplied,

SELECT * FROM articles WHERE articleorganization LIKE '%$organization%'

If both are supplied,

SELECT * FROM articles
WHERE articletitle LIKE '%$title%' AND 
      articleorganization LIKE '%$organization%'

Here's the PHP to make SQL like above:

// Don't forget to properly escape your input
$title = mysql_real_escape_string($_POST['title']);
$organization = mysql_real_escape_string($_POST['organization']);

// Build the SQL
// Echo this string to make sure the SQL is correct
$sql = "SELECT * FROM articles WHERE 1 "
     . (strlen($title) ? "AND articletitle LIKE '%$title%' " : "")
     . (strlen($organization) ? "AND articleorganization LIKE '%$organization%'" : "");

$qry = mysql_query($sql);

Answer 3

$_POST[term] becomes an array with key's like 0,1. Loosing the field reference for your SQL query.

Use these names in your input fields:

<input name="articletitle" type="text" id="articletitle" size="50" />
<input name="articleorganization" type="text" id="articleorganization" size="50" />

You can build your query like this:

$sql = mysql_query("select * from articles WHERE articletitle LIKE '%".mysql_real_escape_string($_POST['articletitle'])."%' OR articleorganization LIKE '%".mysql_real_escape_string($_POST['articleorganization'])."%'");

Note: Never ever use $_POST (user input) vars in a query without escaping first to prevent mysql injection.

PS My personal taste on indenting is: Always indent every block of matching HTML elements. So yes, I would indent the table one tab further.