How to use input data from a form with multiple values in a sql search?

[matt sheeyd]

Hey,

Is it possible to use the value of an input such as <input name=city type=hidden value=usa> to include in a sql select? For instance i would be wanting to
SELECT * from cities where city=the input value above. Can i make it into a variable or something to make it usable in an sql select?

Otherwise i have currently passed it to the header which works fine like this www.example.com/cities.php?city=usa .
And i have used $_GET to get the value of city.
SELECT * from cities where city LIKE '%".$city."%' . But when their is more than 1 city it doesnt work.
www.example.com/cities.php?city=usa canada
SELECT * from cities where city LIKE '%".$city."%' .
Can i split the usa and canada to be like
SELECT * from cities where city LIKE 'usa' OR city LIKE 'canada' .

Any suggestions would be great. I can easily use the input but im not sure if i can get the value out if to use in sql. otherwise can i $_GET the .php?city=usa canada to become
$city1= usa
$city2= canada
instead of $city=usa canada

thanks.

[Niheel]

You should split it.

if cities.php?city=usa canada

$city = explode(" ", $city);

$city[0] // is the value for the first city
$city[1] // is the value for the second city

Also make sure to clean and secure your input, because you're giving it direct access to your database.

[matt sheeyd]

Thanks Again for your help Niheel. I am only new to php and uni hasnt really touched on security yet. I have cleaned and secured it as it submits into the database on the insert page, but are you saying i have to do some security on the .php$city=usa candada page itself? If i stopped users from changing the value of $city would that be sufficient?

Thanks matt.

[Markus]

No. You have no control over what is sent to your server. You do, however, have control over how you process that information. Niheel was suggesting you look into SQL injection. You'll find lots of information on Google on how to prevent this in PHP.