0

My php-mysql code is same as below. 

  <?

   $part[0] = htmlspecialchars($_GET['parta']);
   $lang[0] = htmlspecialchars($_GET['langa']);
   $search[0] = htmlspecialchars($_GET['search']);

   $con = mysqli_connect('localhost','root','autoset','my_db');
   if (!$con)
   {
     die('Could not connect: ' . mysqli_error($con));
   }

   mysqli_select_db($con,"ajax_demo");

    $sql = "SELECT code_co.code, code_co.disease_co, code_en.disease_en
    FROM code_co
    LEFT JOIN code_en ON code_en.code = code_co.code
    ...
    LEFT JOIN sx ON code_co.code = sx.code
    CROSS JOIN (
    SELECT CONCAT(  '%', $part[0]_word.$part[0]_en,  '%' ) AS pattern
    FROM $part[0]_word
    WHERE $part[0]_$lang[0] LIKE  '%".$search[0]."%'
    LIMIT 0 , 1
    )const
    WHERE note LIKE const.pattern
    OR ds_content LIKE const.pattern
    .... 
    OR inclusion LIKE const.pattern";

$part[0]_word.$part[0]_en, $part[0]_word, and $part[0]_$lang[0] LIKE '%".$search[0]."%' are right expressions I wonder ?

And My result displaying code is same as below

  $result = mysqli_query($con,$sql);

   while($row = mysqli_fetch_array($result))
 {
  echo "<table border='1' style='background:#dddddd;border-color:green;'>";

   echo "<tr>";
 echo "<th >"."<form action='search1.php' method='get'>"."<button type='submit' 

  name='code' value='".$row['family']."'>"." Code</th>";
  echo "<th ><a href='".$row['ds_url']."'>"."한국병명</button> </th>";
  echo "<th ><a href='".$row['ds_url']."'>"."Disease name(En.)</a></th>";

 echo "</tr>";
  echo "<tr>";
  echo "<td >" . $row['code'] . "</td>";
  echo "<td >" .$row['disease_co']."</td>";
  echo "<td >" .$row['disease_en']."</td>";

    echo "</tr>";
 echo "</table>";
 }

mysqli_close($con);

Above code dosn't work. I have something wrong, but I cannot solve it. Please give me a piece of advice.

kero
  • 10,647
  • 5
  • 41
  • 51
Drohjho
  • 71
  • 9
  • 1
    Debug this as much as you can by yourself by printing the `$sql` and checking if everything is as it should be as well as checking for [`mysqli_error()`](http://www.php.net/mysqli_error) – kero Feb 20 '14 at 00:28
  • Thanks. I tested that. But no error message. – Drohjho Feb 20 '14 at 00:41
  • What do you mean "doesn't work?" Do you get a result back from the database and are having problems? At first glance it seems fine, but you need to provide more details. Also, you are asking for [SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1) with your current code. Never insert data from users into your database queries. – miken32 Feb 20 '14 at 00:57
  • Actually, the middle parameter in your CONCAT statement is not quoted... – miken32 Feb 20 '14 at 00:58

0 Answers0