oddball MySQL query

[joemyre]

Hi everyone,

What I'm trying to do is take php variables i got from user input, and
pass them as the MySQL query terms.

$query = "select * from ident where ".$searchtype1."=".$searchterm1."";

ERROR: Invalid query: You have an error in your SQL syntax near '=' at
line 1

I have also tried,

$query = "select * from ident where ".$searchtype1." like
'%".$searchterm1."%'";

ERROR: Invalid query: You have an error in your SQL syntax near 'like
'%%'' at line 1

both return similar errors as you can see. I have o idea if the problem
lies with the variable (i try echo-ing, and printing them and i get
nothing) or if it actually is with my sql syntax (i enter the first query
above in mysql from the shell without variable obviously and it returns
the results perfectly). Here is the rest of my code and any help is
greatly appreciated.

Form for getting variables:

<form action="searchrsiident.php" method="post" align="center">
Choose Search Type:<br>
<select name="searchtype1">
<option value="NSN">NSN
<option value="NIIN">NIIN
<option value="NOMENCLATURE">NOMENCLATURE <option value="CAGE">CAGE
<option value="Field5">Field5
<option value="REV">REV
<option value="EQUIP">EQUIP
<option value="RSI_P/N">RSI_P/N
<option value="WAITING_IN">WAITING_IN <option value="NOTES">NOTES
<option value="SOS_CODE">SOS_CODE
<option value="WORK_ORDER">WORK_ORDER <option value="L_QUOTE">L_QUOTE
<option value="A_QTY">A_QTY
<option value="A_PRICE">A_PRICE
<option value="L_WO">L_WO
<option value="L_NOTE">L_NOTE
</select>
<br>
Enter value to search by:<br>
<input name="searchterm1" type=text>
<br>
<input type=submit value="Search">
</form>
Relevent part of my php code (i hope):

$searchtype1 = addslashes($searchtype1); $searchterm1 =
addslashes($searchterm1);

$db = mysql_connect("localhost", "browseuser", "");

if (!$db)
{
echo "Error: Could not connect to database. Please try again
later."; exit;
}
}
mysql_select_db("rsi_ident");
$query = "select * from ident where ".$searchtype1." like
'%".$searchterm1."%'";

$result = mysql_query($query, $db) or die("Invalid query:
".mysql_error()); $num_results = mysql_num_rows($result);
Thanks again

Joe

[Jeffrey Silverman]

On Wed, 16 Jul 2003 08:33:37 -0500, joemyre wrote:

Hi everyone,

What I'm trying to do is take php variables i got from user input, and
pass them as the MySQL query terms.

$query = "select * from ident where ".$searchtype1."=".$searchterm1."";

ERROR: Invalid query: You have an error in your SQL syntax near '=' at
line 1

I have also tried,

$query = "select * from ident where ".$searchtype1." like
'%".$searchterm1."%'";

ERROR: Invalid query: You have an error in your SQL syntax near 'like
'%%'' at line 1
<snip!>
Thanks again

Joe

i haven't read your post thouroughly, but here is my suggestion. First
off, how are you debugging this? I find it very useful to print to the
screen the actual SQL query being sent to the server and test it inside a
MySQL client session if I am having problems. Have you done this?

Try this. Before you pass the query to the MySQL server (using
mysql_query()), echo it to the screen, cut, and paste it into a MySQL
prompt:

$query = "select * from ident where ".$searchtype1." like '%".$searchterm1."%'";
echo "<pre>\n$query\n</pre>";
exit();

highlight, copy, and paste into mysql prompt.

does the query work?
is the query as printed in the browser quite what you expected it would
be?

later...

--
Jeffrey D. Silverman | jeffrey AT jhu DOT edu
Johns Hopkins University | Baltimore, MD
Website | http://www.wse.jhu.edu/newtnotes/

[Shawn Wilson]

joemyre wrote:

$query = "select * from ident where ".$searchtype1." like
'%".$searchterm1."%'";
echo "<pre>\n$query\n</pre>";
exit();

highlight, copy, and paste into mysql prompt.

does the query work?
is the query as printed in the browser quite what you expected it would
be?

Ok I tried printing the query to screen and there is definatly an error
with the variables. The query printed to the screen doesnt even have
them! almost time to start ripping my hair out. thanks for that great
debugging tip Jeffrey.

You might want to try $_POST['searchterm1'] or $_GET['searchterm1'] and the
same for all your other variables. Read PHP for info on global variables.

Shawn
--
Shawn Wilson
sh***@glassgiant.com
http://www.glassgiant.com

[joemyre]

$searchtype1=$_POST['searchtype1'];
$searchterm1=$_POST['searchterm1'];

that worked for me. Al was right on with the global variables hint.
Everything works great now, thanks.

joe