0

i' ve two bugs in my code but i don't understand why... i have a similar code and it's ready correctly... My code is the next:

   if (isset($_POST['buscandoEducateca'])) {
            //get thevariables
        $buscarEducateca = $_POST['buscarEducateca']; // input text from the form
        $tipoBusquedaEducateca = $_POST['tipoBusqueda'];  //select from the form
            //Start the query
        $consultarEducateca = "SELECT '$tipoBusquedaEducateca' FROM AP1_2_tabla_clientes_Consulta WHERE '$tipoBusquedaEducateca'='$buscarEducateca'";
        $resultadoEducateca = mysqli_query($mysqli, $consultarEducateca); //HERE IS ONE WRONG mysqli_query() expects parameter 1 to be mysqli, null given
        $numeroEducateca = 0;

        $ray2 = mysqli_num_rows($resultadoEducateca); // HERE IS THE OTHER WRONG mysqli_num_rows() expects parameter 1 to be mysqli_result, null given


        if ($ray2 > 0) {

                while($rowNumeroEducateca = $resultadoEducateca->fetch_array(MYSQLI_ASSOC)) {

                echo "<tr><td width=\"25%\"><font face=\"verdana\">" . 
                        $rowNumeroEducateca["Nombre"] . "</font></td>";
               [..more..]   
                $numeroEducateca++;
            }

            echo "<tr><td colspan=\"15\"><font face=\"verdana\"><b>Número: " . $numeroEducateca . 
      "</b></font></td></tr>";  

            mysqli_free_result($resultadoEducateca);
        } else {

            echo "No se han encontrado filas, nada a imprimir.";     // if there aren't something tell me didn't found rows or anything to print, when i know that there are.

        }
    }

Also tell me didn't found rows or anything to print.

Thanks, and sorry for my english.

Arturo Veredas Fernandez
  • 1
  • 1
  • For exactly this case, you should try to name (at least) your variables in english. Makes your code readable for almost everyone and if you have to give it away for additions, fixes (or something similar) you don't have to start all over again. – DasSaffe Oct 01 '14 at 13:30
  • 1
    Why @DasSaffe? As long a variable names can be matched up here there isn't any problem. – Jay Blanchard Oct 01 '14 at 13:32
  • 2
    The table name must not be quoted in single quotes. `SELECT $tipoBusquedaEducateca` although it may require backticks `SELECT \`$tipoBusquedaEducateca\`` also `WHERE \`$tipoBusquedaEducateca\`='$buscarEducateca'` Please [read my thorough answer here](http://stackoverflow.com/questions/11321491/when-to-use-single-quotes-double-quotes-and-backticks) – Michael Berkowski Oct 01 '14 at 13:32
  • 1
    Next, there is a SQL injection vulnerability which must be fixed. See [How can I prevent SQL injection in PHP](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). At a minimum you must call `$buscarEducateca = mysqli_real_escape_string($mysqli, $_POST['tipoBusqueda']);` but much better is to begin learning to use `prepare()/execute()` per the examples in the linked question – Michael Berkowski Oct 01 '14 at 13:34
  • @JayBlanchard first off all, it is always good practice to keep the coding guidelines. You could also ask "why would you set curly brackets after an `if`, if you only have one command following" or "why would you use camel-case or even intend your code" – DasSaffe Oct 01 '14 at 13:34
  • Coding guidelines? You means his, or SO's? And don't get me started on curly brackets...or semi-colons. Those are holy wars in which I have learned how to keep peace. ¯\_(ツ)_/¯ – Jay Blanchard Oct 01 '14 at 13:36
  • A final important security issue to consider. You must not allow `$tipoBusquedaEducateca` as a value directly from `$_POST`. Check if it is a known table like `if (in_array($_POST['tipoBusqueda'], array('table1', 'table2')) {...}` – Michael Berkowski Oct 01 '14 at 13:37

1 Answers1

0

$mysqli want to be declared first. It is should be some thing like this.

$mysqli = mysqli_connect("yourhost","username","password","dbname");
Nissam
  • 1
  • 1