- You are connecting with procedural syntax, then performing all query processes with object-oriented syntax. Choose one style and stick with it - I recommend OO all the way through.
- Using all caps for mysql keywords will improve the readability of your queries, and is generally good practice.
- You have not declared the three targeted columns in your SELECT clause. This is a query killer.
$tutorial_title if a trusted value (not from a user submission) and cannot possibly contain a single quote, should be wrapped in single quotes. If the value may contain a single quote or comes from an insecure source, you should use a prepared statement with a placeholder and a bound variable.
- To help you with debugging, check for a false result from your query. - You don't need to count the rows unless you are going to display a special message which states that there were no rows found.
- The while loop will only iterate if there is something to iterate, so it is a safe call.
- The
;# in your echo line will only cause trouble, remove it.
My recommended/untested code:
if (!$conn = new mysqli($dbhost, $dbuser, $dbpass, $Database)) {
echo "connection error"; // $conn->connect_error;
} elseif (!$stmt = $conn->prepare("SELECT tutorial_title, tutorial_author, submission_date FROM Tutorial_tbl WHERE tutorial_title = ?")) {
echo "query syntax error"; // $conn->error;
} elseif (!$stmt->bind_param("s", $tutorial_title) || !$stmt->execute() || !$stmt->bind_result($title, $author, $date)) {
echo "statement error"; // $stmt->error;
} else {
echo "<table>";
echo "<tr><th>Title</th><th>Author</th><th>Date</th></tr>";
while ($stmt->fetch()) {
echo "<tr><td>$title</td><td>$author</td><td>$date</td></tr>";
}
echo "</table>";
$stmt->close(); // optional
$conn->close(); // optional
}
In the above snippet, I've baked in falsey conditional checks at each point to enable simple debugging. I have commented out the error functions, so that this code could be copy-pasted. Just be aware that you must never show the actual error messages to a public audience as a matter of security.
Using bind_result() is very handy when you know exactly which columns you will be returning -- the display syntax is very clean.