i want to search and display the data from database but it gives me error

Question

this is my search_candidate.php file

<?php

   $name = $_GET['name'];
   $sql = "SELECT * FROM candidates WHERE Name = $name";
   $query = mysql_query( $sql );
          if(mysql_num_rows($query) == "")
          {
          echo "no result found";
          }
          echo "<table>";

          echo "<thead></thead>";
                while( $row = mysql_fetch_array( $query ) )
                     {
                      echo "<tr></tr>";
                     }
          echo "</table>";
?>

`$query = mysql_query( $sql ) or die(mysql_error());` and see the error you're not checking for. — Funk Forty Niner, Jan 23 '15 at 12:49
**Please, [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php).** They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). **Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement)** instead, and **use [PDO](http://us1.php.net/pdo).** **[DANGER! You need to prevent SQL Injection!](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)** — Jay Blanchard, Jan 23 '15 at 15:27

score 4 · Answer 1 · edited May 23 '17 at 10:26

4

SELECT * FROM candidates WHERE Name = $name

$name is a string and needs to be in quotes like '$name'

But even after that fix you wont get anything because your loop doesnt print any data. It just opens and closes new rows without anything inside.

How can I prevent SQL injection in PHP?

edited May 23 '17 at 10:26

Community

1
1

answered Jan 23 '15 at 12:41

Hanky Panky

45,969
8
69
95

Huzoor Bux · Answer 2 · 2015-01-23T13:05:40.940

2

Try this code it will work.

<?php

   $name = $_GET['name'];
   $sql = "SELECT * FROM candidates WHERE Name = '$name'";
   $query = mysql_query( $sql );
          if(mysql_num_rows($query) == "")
          {
          echo "no result found";
          }
          echo "<table>";

          echo "<thead></thead>";
                while( $row = mysql_fetch_array( $query ) )
                     {
                      echo "<tr><td>".$row['name']."</td></tr>";
                     }
          echo "</table>";
?>

Copied code from question and make changes on 2 errors $name string must be in quotes and added <td>".$row['name']."</td> in your loop to show something.

Your code allow any one to inject so try to use PDO or MySQLi connection.

edited Jan 23 '15 at 13:05

answered Jan 23 '15 at 12:42

Huzoor Bux

1,022
4
20
45

Why was this downvoted? – Funk Forty Niner Jan 23 '15 at 12:48
@Fred-ii- People don't like help so.. – Huzoor Bux Jan 23 '15 at 12:50
I know the feeling. Must be having bad coffee. – Funk Forty Niner Jan 23 '15 at 12:50
@HuzoorBux Maybe you can also highlight where the error is and explain why you have to put `$name` in quotes, also don't understand how downvoted this – Rizier123 Jan 23 '15 at 12:53
@Rizier123 you are right my mistake. – Huzoor Bux Jan 23 '15 at 12:55
1

Please don't be judgmental about down-votes so fast. I'll tell you why this was down-voted. This answer took the pain to copy paste code from question and fix one string quotation mark and failed to realize that rest of the pasted code is still wrong, it doesn't output any data. All what this loop does is `echo "";` Does that produce the output? Why reproduce wrong code? – Hanky Panky Jan 23 '15 at 12:59
1

@Hanky웃Panky True true, but the fix is still partially there. OP needs to fix it and here too, but I agree. I hadn't noticed that originally. – Funk Forty Niner Jan 23 '15 at 13:02
Now that we know the reason, i'll retract the down-vote. – Hanky Panky Jan 23 '15 at 13:05
@Hanky웃Panky Thanks for pointing me i have fixed that error and add some more explanation in it. – Huzoor Bux Jan 23 '15 at 13:06

score 1 · Answer 3 · answered Jan 23 '15 at 12:41

1

Seems name is string so add a quote to $name in query

$sql = "SELECT * FROM candidates WHERE Name = '$name'";

Note :- mysql_* has been deprecated use mysqli_* or PDO.

answered Jan 23 '15 at 12:41

Rakesh Sharma

13,570
4
35
42

i want to search and display the data from database but it gives me error

3 Answers3