How do I compare input to mysql data with php/sql?

Question

I'm new to working with PHP and a mySQL DB. I"m trying to make a user input there user name(UN) to enter this one part of my site. I have a mySQL DB(test) with a users table called "test". I know that I'm connecting ok, because I tested it by creating a simple page to open the DB and list all the users(from the UN field), or select a specific one. I then created a page called "input.php" for a test of getting input. As seen here>

<html>
 <body>
 <form action="test.php" method="get">
 UN: <input type="text" name="U">
 <input type="submit">
 </form>
 </body>
 </html>

The input from above goes to "test.php" below where it is checked with current data in my DB.

<?php
$hostname = "test.db.some#.somehost.com";
    $username = "test";
    $dbname = "test";
$password = "password";
$usertable = "test";
$yourfield = "UN";
    mysql_connect($hostname, $username, $password) OR DIE ("Unable to 
        connect to database! Please try again later.");
    mysql_select_db($dbname);
$query = "SELECT * FROM $usertable WHERE $yourfield = $_GET["U"]";
    $result = mysql_query($query);
    if ($result) {
        while($row = mysql_fetch_array($result)) {
                $name = $row["$yourfield"];
                echo "Hello: $name<br>";
            }
    }
    else {
        echo "User dosen't exit!";
    }
    mysql_close();
?>

And this is the error I get> *Parse error: syntax error, unexpected '"', expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/content/81/11107981/html/test.php on line 20*

I know I'm close, but I want the cigar. ;)

Konstantin Yovkov · Accepted Answer · 2013-05-17 23:25:39Z

1

I think the problem is that you don't escape the quotes in the query:

Try the following:

$u = $_GET['u'];
$query = "SELECT * FROM $usertable WHERE $yourfield = " . $u;

answered May 17, 2013 at 23:25

Konstantin Yovkov

63k9 gold badges107 silver badges152 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sumoanand · Accepted Answer · 2013-05-17 23:36:54Z

1

mysql_* are deprecated. You should avoid them.

Change

mysql_connect($hostname, $username, $password) OR DIE ("Unable to 
    connect to database! Please try again later.");

to

$connection = mysql_connect($hostname, $username, $password) OR DIE ("Unable to 
connect to database! Please try again later.");

,

$query = "SELECT * FROM $usertable WHERE $yourfield = $_GET["U"]";

to

$query = "SELECT * FROM $usertable WHERE $yourfield = '".$_GET["U"]."'";

And

mysql_close();

to

mysql_close($connection);

edited May 17, 2013 at 23:36

answered May 17, 2013 at 23:30

Sumoanand

8,9293 gold badges50 silver badges46 bronze badges

6 Comments

ontananza Over a year ago

mysql_* deprecated as PHP 5.5.0, and will be removed in the future.

Bob Todd Over a year ago

Wow, thanks for the fast response #1 :D #2 it works now. Yes, I must be using an old example of working with mysql code that my web host provided for me. May mucho Karma smile upon you. :)

Sumoanand Over a year ago

Good to know that it helped. Probably, you can accept this answer then ;)

Bob Todd Over a year ago

Oh, but I'm having different problem now. When I enter a user name that is in the dB it works, but when I enter a user name this is not in the dB it doesn't do anything, just blank page. Its supposed to come back with an error. Its not getting to the final else statement for some reason.

Sumoanand Over a year ago

because it is still executing the code under if condition. Write echo "i am here" outside while loop & you will come to know.

|

Naveed · Accepted Answer · 2013-05-17 23:31:46Z

0

You should write the query like this instead:

$query = "SELECT * FROM $usertable WHERE $yourfield = '" . $_GET["U"] . "'";

Or you can write it like this:

$query = "SELECT * FROM $usertable WHERE $yourfield = '{$_GET["U"]}'";

answered May 17, 2013 at 23:31

Naveed

1,22111 silver badges22 bronze badges

Comments

alwaysLearn · Accepted Answer · 2013-05-18 05:05:36Z

your first problem is solved but here is the solution to your second problem along with the help to convert this code to mysqli

<?php
$hostname = "test.db.some#.somehost.com";
$username = "test";
$dbname = "test";
$password = "password";
$usertable = "test";
$yourfield = "UN";
$connect   =  mysqli_connect($hostname, $username, $password) OR DIE ("Unable to 
    connect to database! Please try again later.");
mysqli_select_db($dbname);

/* You can combine the above two lines in oen in mysqli by giving db name as fourth parameter
 mysqli_connect($hostname, $username, $password, $dbname)

*/

$query = "SELECT * FROM $usertable WHERE $yourfield = $_GET["U"]";
$result = mysqli_query($query);
$rowSelected   = mysqli_num_rows($result);
if ($rowSelected ) {
    while($row = mysqli_fetch_array($result)) {
            $name = $row["$yourfield"];
            echo "Hello: $name<br>";
        }
}
else {
    echo "User dosen't exit!";
}
mysqli_close($connect);
?>

mysql_query or mysqli_query will return the resource .. and that will be true irrespective of whether rows are fetched or not ..what you need to check if there is any data that is being fetched in actual .. so use mysqli_num_rows(mysqli version of mysql_num_rows)

Collectives™ on Stack Overflow

How do I compare input to mysql data with php/sql?

4 Answers 4

Comments

6 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

6 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related