telephone directory with mysql

Question

I have been programming a telephone directory and i am now facing a problem.
When I enter ime and prezime (which are name and surname in english), I can not get broj (which is telephone number in english) of that person.

<?php

        mysql_connect ("localhost", "root", "");
        mysql_select_db ("imenik");
        mysql_set_charset('utf8');

        if (isset ($_POST['ime']) && isset ($_POST['prezime'])){

            if (!empty ($_POST['ime']) && !empty ($_POST['prezime'])){
                $trazeno_ime = $_POST('ime');
                $trazeno_prezime = $_POST('prezime');

                $query = "SELECT broj_telefona, adresa FROM korisnici WHERE ime='$trazeno_ime' AND prezime='$trazeno_prezime'";


                    if ($query_run = mysql_query($query)){

                        if(mysql_num_rows($query_run)==NULL){
                            echo "Nema korisnika u bazi";
                        }

                        else {
                            $query_row = mysql_fetch_assoc($query_run);
                            $brojtel = $query_row["broj_telefona"];
                            $adresa = $query_row["adresa"];

                            echo "Broj: ".$brojtel."<br>";
                            echo "Adresa: ".$adresa;

                        }

                    }
                else {
                    echo "Unesi podatke";
                }
                }


        }

    ?>

**warning** your code is extremely vulnerable to sql injection attacks! — Daniel A. White, Jan 06 '15 at 18:59
Add error reporting to the top of your file(s) right after your opening ` — Funk Forty Niner, Jan 06 '15 at 19:00
`$_POST('ime')` and `$_POST('prezime')` those should be square brackets `[]`, not `()`. — Funk Forty Niner, Jan 06 '15 at 19:03
Please, [don't use `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) instead, and use [PDO](http://us1.php.net/pdo) or [MySQLi](http://us1.php.net/mysqli). [Prevent SQL Injection!](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Jan 06 '15 at 19:05

score 0 · Accepted Answer · answered Jan 06 '15 at 19:05

0

Change these lines:

$trazeno_ime = $_POST('ime');
$trazeno_prezime = $_POST('prezime');

To:

$trazeno_ime = $_POST['ime'];
$trazeno_prezime = $_POST['prezime'];

and you should take a look at PDO or Prepared Statements, since msyql_ functions are depricated.

answered Jan 06 '15 at 19:05

*"Change these lines:... To"* - There is a reason. – Funk Forty Niner Jan 06 '15 at 19:06

telephone directory with mysql

1 Answers1