<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<title>اول اسكربت باذن الله</title>
</head>
<body>
<table width="100%" border="1">
<tr>
<td>name</td>
<td>number</td>
<td>math</td>
<td>arab</td>
<td>history</td>
<td>geo</td>
</tr>
<?php
require_once "conf.php";
$sql2=("SELECT * FROM student WHERE snum = $ss");
$rs2 = mysql_query($sql2) or die(mysql_error());
$num = mysql_num_rows($rs2);
$ss= $_POST["ss"];
if (empty($ss))
{ echo "please write your search words";}
else if ($num < 1 ) {
echo "not found any like ";
}else {
$sql=("SELECT * FROM student WHERE snum = $ss ");
$rs = mysql_query($sql) or die(mysql_error());
while($data=mysql_fetch_array($rs)){
$name=$data["sname"];
$number=$data["snum"];
$math=$data["math"];
$arab=$data["arab"];
$history=$data["history"];
$geo=$data["geo"];
echo"
<tr>
<td>$name</td>
<td>$number</td>
<td>$math</td>
<td>$arab</td>
<td>$history</td>
<td>$geo</td>
</tr>
";
}
};
?>
</table>
</body>
</html>
views:
84answers:
5
+1
A:
Is $ss a string? Should you have this?
$sql2=("SELECT * FROM student WHERE snum = '$ss'");
David M
2010-06-09 09:55:59
no it is number num $sql2=("SELECT * FROM student WHERE snum = $ss");
magy
2010-06-09 09:57:08
SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";-- Database: `custom`-- Table structure for table `student`CREATE TABLE IF NOT EXISTS `student` ( `id` int(11) NOT NULL auto_increment, `sname` varchar(100) NOT NULL, `snum` int(15) NOT NULL, `math` int(10) NOT NULL, `arab` int(10) NOT NULL, `history` int(10) NOT NULL, `geo` int(10) NOT NULL, PRIMARY KEY (`id`)) ENGINE=MyISAM DEFAULT CHARSET=cp1256 AUTO_INCREMENT=3 ;
magy
2010-06-09 10:01:18
+2
A:
You are passing non-existing variable $ss to your query before it exits:
$sql2=("SELECT * FROM student WHERE snum = $ss"); // <-- problem here
$rs2 = mysql_query($sql2) or die(mysql_error());
$num = mysql_num_rows($rs2);
$ss= $_POST["ss"];
Try this:
require_once "conf.php";
$ss= $_POST["ss"];
if (empty($ss))
{ echo "please write your search words";}
else if ($num < 1 ) {
echo "not found any like ";
}else {
$sql=("SELECT * FROM student WHERE snum = $ss ");
$rs = mysql_query($sql) or die(mysql_error());
// and more code...
Sarfraz
2010-06-09 09:56:06
+3
A:
You cannot use a variable that was not initialized. In your case $ss is probably undefined when you use it to build the query in $sql2. That results in an invalid SQL statement as there is nothing after the = operator.
Try this instead:
require_once "conf.php";
if (!isset($_POST["ss"])) {
echo "please write your search words";
} else {
$ss = $_POST["ss"];
$query = "SELECT * FROM student WHERE snum = '".mysql_real_escape_string($ss)."'";
$result = mysql_query($query) or die(mysql_error());
if (mysql_num_rows($result) == 0) {
echo "not found anything like ".htmlspecialchars($ss);
} else {
while ($data=mysql_fetch_array($result)) {
// …
}
}
}
Gumbo
2010-06-09 09:57:08
+1
A:
I think $ss= $_POST["ss"]; should go before
$sql2=("SELECT * FROM student WHERE snum = $ss");
Cris
2010-06-09 09:59:12
+1
A:
Seriously ?
First : php is a simple programing language. It executes whatever you give to it in the order you give it. That's why the $ss variable you try to use in your query does not exist when you try to use it. You should assign it's value before using it.
Now, let's start being an ass.
$_POST['ss'] is supplied by your user. Don't trust it. Never trust user input ! They want to take control of your server so they can find you and kidnap you to ask for some ransom.
So don't use it in your query without checking its value. Imagine if you user sends $_POST['ss'] = '1 OR 1';
The best way to deal with this kind of thing is to use parameterized queries with mysqli or PDO.
Arkh
2010-06-09 10:10:32