0

I'm trying to use the following code to make a search on my website in the database, the goal is to return all columns in multiple tables that contain the search including the parent-table which I have included in as a column in the tables.

$schema = 'maps';
$search = '%'.$_GET["ident"].'%';

$query1 = "
    select TABLE_NAME
    from information_schema.tables
    where TABLE_SCHEMA = '{$schema}'";

$result1 = mysql_query($query1);
$queryParts = array();
while($row = mysql_fetch_assoc($result1)) {
    $table = $row['TABLE_NAME'];
    $queryPart = "
    select name, isin, parent
    from `maps`.`{$table}`
        where `isin` like '{$search}'
    ";
    $queryParts[] = $queryPart;
}
$unionQuery = implode(' union all ', $queryParts);

$result2 = mysql_query($unionQuery);

and echo using:

while($row = mysql_fetch_array($result2))
                        {
                            $f1 = $row['name'];
                            $f2 = $row['parent'];
}

I get the following error

mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\home\security.php on line 55

Cœur
  • 34,719
  • 24
  • 185
  • 251
Felix Eklöf
  • 2,446
  • 1
  • 8
  • 17
  • 1
    You are also vulnerable to [sql injection attacks](http://bobby-tables.com) – Marc B Oct 31 '16 at 17:08
  • **WARNING**: If you're just learning PHP, please, do not use the [`mysql_query`](http://php.net/manual/en/function.mysql-query.php) interface. It’s so awful and dangerous that it was removed in PHP 7. A replacement like [PDO is not hard to learn](http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/) and a guide like [PHP The Right Way](http://www.phptherightway.com/) explains best practices. Your user parameters are **not** [properly escaped](http://bobby-tables.com/php) and there are [SQL injection bugs](http://bobby-tables.com/) that can be exploited. – tadman Oct 31 '16 at 18:12
  • Thanks for the warning, I've started implementing PDO now, can I use the some query but call them with PDO? Or are the queries themself unsafe? Thanks. – Felix Eklöf Nov 04 '16 at 15:45

0 Answers0