php search function does not work

Question

I am trying to do "search user by name button" to search the user's database, is show "Result Error" cannot get the user details. I don't know which part got problem. Please help me. Every help would be appreciated. Here is my code.

manageruser.php

<?php 
include("include/config.php");

   $name = "";
   $username = "";
   $password = "";
   $ic = "";
   $contact = "";
   $email = "";
   $nationality = "";
   $program = "";
   $firstintake = "";

   function getPosts()
   {
       $posts = array();
       $posts[0] = $_POST['name'];
       $posts[1] = $_POST['username'];
       $posts[2] = $_POST['password'];
       $posts[3] = $_POST['ic'];
       $posts[4] = $_POST['contact'];
       $posts[5] = $_POST['email'];
       $posts[6] = $_POST['nationality'];
       $posts[7] = $_POST['program'];
       $posts[8] = $_POST['firstintake'];
       return $posts;
   }

// Search
   if(isset($_POST['search']))
   {
       $data = getPosts();

       $search_Query = "SELECT * FROM user WHERE u_name = $data[0]";

       $search_Result = mysqli_query($link, $search_Query);

       if($search_Result)
       {
          if(mysqli_num_rows($search_Result))
          {
            while($row = mysqli_fetch_array($search_Result))
            {
                $name = $row['u_name'];
                $username = $row['u_unm'];
                $password = $row['u_pwd'];
                $ic = $row['u_ic'];
                $contact = $row['u_contact'];
                $email = $row['u_email'];
                $nationality = $row['u_national'];
                $program = $row['u_program'];
                $firstintake = $row['u_fintake'];
            }
          }
          else
          {
            echo "No Data For This Name";
          }
       }
       else
       {
        echo "Result Error";
       }
   }

?>

<fieldset>
<legend>Manage User</legend>
<form name="ManForm" method="post" action="manageuser.php">
<table>
    <tr>
        <td>Name:</td>
        <td><input id="name" name="name" type="text" class="input" pattern="[A-Z\s]+" 
        title="Please enter capital letters" value="<?php echo $name; ?>">
        <span>(Full name) *must capital letters</span></td>
    </tr>

    <tr>
        <td>Username:</td>
        <td><input id="username" name="username" type="text" class="input" value="<?php echo $username; ?>"></td>
    </tr>

    <tr>
        <td>Password:</td>
        <td><input id="password" name="password" type="password" class="input" value="<?php echo $password; ?>"></td>
    </tr>

    <tr>
        <td>Identity card /Passport number:</td>
        <td><input id="ic" name="ic" type="text" class="input" value="<?php echo $ic; ?>"></td>
    </tr>

    <tr>
        <td>Contact number:</td>
        <td><input id="contact" name="contact" type="text" class="input" value="<?php echo $contact; ?>"></td>
    </tr>

    <tr>
        <td>Email:</td>
        <td><input id="email" name="email" type="text" class="input" value="<?php echo $email; ?>"></td>
    </tr>

    <tr>
        <td>Nationality:</td>
        <td><input id="nationality" name="nationality" type="text" class="input" value="<?php echo $nationality; ?>"></td>
    </tr>

    <tr>
        <td>Program:</td>
        <td><input id="program" name="program" type="text" class="input" value="<?php echo $program; ?>"></td>
    </tr>

    <tr>
        <td>First intake:</td>
        <td><input id="firstintake" name="firstintake" type="text" class="input" value="<?php echo $firstintake; ?>"></td>
    </tr>
</table>

    <div>
        <input type="submit" name="search" value="  Search User By Name">
        <input type="submit" name="update" value="  Update User Details">
        <input type="submit" name="delete" value="  Delete User ">
    </div>

</form>
</fieldset>

config.php

<?php

    $link= mysqli_connect("localhost","root","","course_registration_system");

?>

Answer 1

The problem here is that you are running your query wrong way.
To run your query you should be using a prepared statement.

It is very important to understand that simply adding quotes around a variable is not enough and will eventually lead to innumerable problems, from syntax errors to SQL injections. On the other hand, due to the very nature of prepared statements, it's a bullet-proof solution that makes it impossible to introduce any problem through a data variable.

So, for every query you run, if at least one variable is going to be used, you have to substitute it with a placeholder, then prepare your query, and then execute it, passing variables separately.

First of all, you have to alter your query, adding placeholders in place of variables. Say your query will become like this

"SELECT * FROM user WHERE u_name = ?"

then you will have to prepare it, bind variables, and execute

So you should be doing like this

$stmt = $link->prepare("SELECT * FROM user WHERE u_name = ?");
$stmt->bind_param("s", $data[0]);
$stmt->execute();
$result = $stmt->get_result();
while($row = $result->fetch_array())
{

Answer 2

Use quote around your search string in query or try this instead -

$search_Query = "SELECT * FROM user WHERE u_name = '" .$data[0]."'";