PHP - Search box doesnt work

Question

I'm trying to create a search box with classes, i always use a specific code for this, whithout using classes.

But now, im learning how to use classes, and i need to transfer my old code, to a single class, i tried this function:

function verGaleria() {
    $sql = "SELECT * FROM `cds`";
    if(($rs=$this->bd->executarSQL($sql))){
      if(isset($_GET['buscar'])){
        $sql = mysql_query("SELECT * FROM `cds` where name like '%".$_GET['buscar']."%'");
      }

      while ($row = mysql_fetch_array($rs)) {                   
              $imagem = $row['imagem'];
              $ID = $row['ID'];
              $artista = $row['artista'];
              $preco = $row['preco'];
              $titulo = $row['titulo'];

        echo '      
                <style>
                .teste{
                text-align:center; display: inline-block; width:300px; margin: 0 0 40px 30px;   float:left; color:white;
                }
                </style>
          <div class="teste">
                  <h1>'.$titulo.'</h1>
                      <h2><img class="cd" src="CDs/'.$imagem.'" width="102" height="126" alt="'.$artista.'"/></h2>
                        <h3>'.$preco.'€</h3>
          </div>
            ';
    }   
  } else {
    return false;
    }
}

My from code:

<form method="GET" name="buscar" >
 <label><a class="utilizador">Procurar</a>
 <br />
   <input type="text" name="buscar" id="prc" placeholder="Ex: Rock"/></label>
    <input type="submit" class="submitprc" value="Pesquisar" />
</form>

what is the issue? Did you deliberately leave the `action` attribute from the form tag? — Lucky Soni, Dec 08 '13 at 16:04
[Your code is vulnerable to SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — PeeHaa, Dec 08 '13 at 16:10
Is the function `verGaleria()` getting called? Is the `$rs=$this->bd->executarSQL($sql)` succeeding? — Atle, Dec 08 '13 at 16:11
@Mihal, better to replace `$sql = mysql_query` with `$rs = mysql_query` ? — Atle, Dec 08 '13 at 16:18

score 1 · Accepted Answer · answered Dec 08 '13 at 16:15

You are executing the initial SQL query $sql = "SELECT * FROMcds"; which fetches all the products and storing all results in $rs like so $rs=$this->bd->executarSQL($sql)

Then you check if search query is present isset($_GET['buscar']) and if it is present then you form your new sql statement $sql = mysql_query("SELECT * FROMcdswhere name like '%".$_GET['buscar']."%'"); but you never execute it.

Then you use $rs to show the results..

while ($row = mysql_fetch_array($rs)) {
    $imagem = $row['imagem'];
    $ID = $row['ID'];
    $artista = $row['artista'];
    $preco = $row['preco'];
    $titulo = $row['titulo'];
//code
}

What you should do is something like:

<?php

isset($_GET['buscar']) ?
    $sql = "SELECT * FROM `cds` where name like '%".$_GET['buscar']."%'" :
    $sql = "SELECT * FROM `cds`";

$result = mysql_query("SELECT * FROM `cds` where name like '%".$_GET['buscar']."%'", $conn); // pass in your connection object

 if(! $result )
 {
    die('Could not get data: ' . mysql_error());
 }

 while ($row = mysql_fetch_array($result)) {
    $imagem = $row['imagem'];
    $ID = $row['ID'];
    $artista = $row['artista'];
    $preco = $row['preco'];
    $titulo = $row['titulo'];

   //code
}

PHP - Search box doesnt work

1 Answers1