why $result cannot display when insert two values?

Question

<table width="300" border="1">
<tr>
<td>
<div class="tourmain">
  <?php    
        $result=mysql_query("SELECT * FROM foodmenu where food_type = 'Appetizers' and restaurant_name = 'Chili's "); 
        while($row=mysql_fetch_array($result)){
             ?>
    <dl>
        <dt><a href="food.php?id=<?php echo $row['foodID'];?>"><img src="<?php echo $row['food_img'];?>" width="280" height="200" /></a></dt>
      <dd>
       <span><?php echo $row['food_type'];?></span>
        </dd>
  </dl>
     <?php }?>
</div>
</td>

<td><div class="tourmain">
  <?php    
        $result=mysql_query("SELECT * FROM foodmenu where food_type = 'Main Courses'"); 
        while($row=mysql_fetch_array($result)){
             ?>
    <dl>
        <dt><a href="food.php?id=<?php echo $row['foodID'];?>"><img src="<?php echo $row['food_img'];?>" width="280" height="200" /></a></dt>
      <dd>
       <span><?php echo $row['food_type'];?></span>
        </dd>
  </dl>
     <?php }?>
</div>

My problem is when I'm inserting two values inside the $result, it display empty in the table column. E.g. Select * from foodmenu where food_type='Appetizers' and restaurant_name='Chili's', this shows empty result in the table column.

But when Select * from foodmenu where food_type='Appetizers', it will display all the food_type with value 'Appetizers'.

Why the selected restaurant key in cannot display the result relative to its food_type? May I know any solutions for that?

Spot the `'` in `Chili's'`.... What effect do you thing that has on your query string? If you have a quote in a value to use in a SQL query, you need to escape it.... or better yet, move into the 21st century, and start using prepared statements/bind variables with MySQLi or PDO, rather than using the old, soon to be obliterated from existence in PHP MySQL extension — Mark Baker, Oct 21 '15 at 08:24
possible duplicate of http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Funk Forty Niner, Oct 24 '15 at 12:28

score 2 · Answer 1 · edited Oct 21 '15 at 08:26

2

Quotes are the problem in your query.

You have to use mysql_real_escape_string

$var = mysql_real_escape_string("Chili's");
$result = mysql_query("SELECT * FROM foodmenu where food_type = 'Appetizers' and restaurant_name = '".$var."' ");

edited Oct 21 '15 at 08:26

Tim Biegeleisen

502,043
27
286
360

answered Oct 21 '15 at 08:26

Saty

22,443
7
33
51

score 0 · Answer 2 · answered Oct 21 '15 at 23:23

<div class="detailtop">
    <?php    
        $var = mysql_real_escape_string("Chili's");
        $result = mysql_query("SELECT * FROM foodmenu where food_type = 'Appetizers' and restaurant_name = '".$var."' "); 
        while($row=mysql_fetch_array($result)){
             ?>
        <dl>
            <dt>
            <img src="<?php echo  $row["food_img"];?>" /> </dt>
            <dd>
    <form action="order.php" method="post" name="send" onSubmit="return Check()"  enctype="multipart/form-data">
                <h3><?php echo  $row["food_name"];?></h3>
                <div class="detailtips">
                    <?php echo  $row["food_description"];?>
                </div>
                <p><span>Type:</span><strong><?php echo  $row["food_type"];?></strong></p>
                <p><span>Price:</span><strong><?php echo  $row["food_price"];?><input name="num"  type="hidden" class="num" value="<?php echo  $row["food_price"];?>" /></strong>RM</p>

                <div class="order" style=" padding-top:20px; padding-left:20px;">
                <input name="id" type="hidden" value="<?php echo  $row["foodID"];?>" />
                <input name="" type="submit"  value="" class="ordersubmit" style=" margin-left:53px;">
                </div>
                </form>
            </dd>
        </dl>
        <?php }?>
  </div>

Previous coding can be run, it can display all the data from database with relative values. But I want to ask if I click one of the img, it will display only one food with its own foodID, but I'm using the coding above it also display all the foods. What should I do for this step? I just need only one food info display when click on one of the img on the previous coding. Since my coding need to display many restaurants page and menu items, I just need it to suit with my foodID that already set in database.

why $result cannot display when insert two values?

2 Answers2