Create a HTML Form to Search SQL Database

Question

I have a HTML Form with Drop Down options which pass the values to php sql query I have on the same page as the form. This works if I use the values with LIKE statements but when I try to use the posted values with BETWEEN or >= it doesnt work. If i try with the actual values it does work. Could someone advise on what I am doing wrong. I have posted my HTML Form with the PHP code for the SQL Query.

HTML:

<html><form action="#" method="GET"></select>
        <select name="MinPrice">
        <option value="">Min Price</option>
        <option value="">No Min</option>
        <option value="500">£500</option>
        <option value="600">£600</option>
        <option value="700">£700</option>
        <option value="800">£800</option>
        <option value="900">£900</option>
        <option value="">Show All</option>
        </select> 
        <select name="MaxPrice">
        <option value="">Max Price</option>
        <option value="">No Max</option>
        <option value="500">£500</option>
        <option value="600">£600</option>
        <option value="700">£700</option>
        <option value="800">£800</option>
        <option value="900">£900</option></select></form></html>

PHP:

<?php
mysql_connect("****", "****", "****");
mysql_select_db("****"); 
$sql = mysql_query("SELECT * FROM Product WHERE Price >= '%$_GET[MinPrice]%'"); 
echo "<h3>...Something...";

Or

    <?php
mysql_connect("****", "****", "****");
mysql_select_db("****"); 
$sql = mysql_query("SELECT * FROM Product WHERE Price BETWEEN '%$_GET[MinPrice]%' AND '%$_GET[MaxPrice]%'"); 
echo "<h3>...Something...";

i dont get any results back, but if i exchange the GET Values with actual numbers it works as I want. Anyone got any suggestions on this?

I have tried absolutely everything I know

Remove the % signs in your query. You only use these (afaik) when using LIKE. — Peter, Jan 06 '15 at 13:31
Be careful - your solution is prone to sql injection http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Bert Wagner, Jan 06 '15 at 14:03

score 0 · Answer 1 · answered Jan 06 '15 at 13:53

0

why action is "#" ? if your php code is another page put the name in actions :

ex:

<form action="selectproduct.php" method="GET">

or if php code is on html page set action :

<form  action="<?php $PHP_SELF?>" method="GET">

answered Jan 06 '15 at 13:53

osman Rahimi

1,427
1
11
26

Thank you for this, yes my php code is on the same as html. I will move this at a later stage. – RKK86 Jan 06 '15 at 19:39

score 0 · Answer 2 · answered Jan 06 '15 at 14:02

0

sorry, I can't comment, but could you just change:

echo "<h3>...Something...";

to

echo $sql;

or

var_dump($sql)

and compare value of $sql when you use $_GET and use "actual numbers"

there must be difference :-) ;-)

answered Jan 06 '15 at 14:02

Alex

16,739
1
28
51

Create a HTML Form to Search SQL Database

2 Answers2