DB Query Help Please

[phpretard]

$Type=$_POST['Type'];

$mainSearch=$_POST['mainSearch'];

 

SELECT * FROM table WHERE City, State, ZipCode LIKE '$mainSearch%' AND $type='1'

 

Why doesn't this work?

 

It works without the -- , State, ZipCode -- so I know that' the problem.

 

I just don't know the repair.

 

Any help?

[scarhand]

first off, what you have is extremely dangerous

 

you MUST use mysql_real_escape_string for any $_POST values unless you have gone through lengths that ensures characters entered could not be malicious

 

secondly, youre using 2 different variables. "$Type" is NOT the same as "$type". variables are case sensitive, that is why it is not working.

[phpretard]

Could you be a little more specific about the real escape string please and the proposed dangers?

[d.shankar]

About 99.9% of SQL Injection attacks can be averted by using this mysql_real_escape_string function.
This is how you use it for the $_POST variables before sending it to your back-end.

<?php
$Type=$_POST['Type'];
$mainSearch=$_POST['mainSearch'];

$Type=mysql_real_escape_string($Type);
$mainSearch=mysql_real_escape_string($mainSearch);

//Perform your DB Operations here.
?>

[LemonInflux]

About 99.9% of SQL Injection attacks can be averted by using this mysql_real_escape_string function.
This is how you use it for the $_POST variables before sending it to your back-end.

<?php
$Type=$_POST['Type'];
$mainSearch=$_POST['mainSearch'];

$Type=mysql_real_escape_string($Type);
$mainSearch=mysql_real_escape_string($mainSearch);

//Perform your DB Operations here.
?>

 

Or, if you're a real line-counter :

 

<?php
$Type=mysql_real_escape_string($_POST['Type']);
$mainSearch=mysql_real_escape_string($_POST['mainSearch']);

//Perform your DB Operations here.
?>

 

----------------

Now playing: Enter Shikari - Adieu (Routron 5000 Remix)

via FoxyTunes

[d.shankar]

[Wolphie]

Try this:

 

$query = sprintf("SELECT * FROM `table` WHERE `City`, `State`, `ZipCode` LIKE '%s' AND `%s` = '1'", 
  mysql_real_escape_string('%'. $_POST['mainSearch'] .'%'),
  mysql_real_escape_string($_POST['Type'])
);
$result = mysql_query($query) or trigger_error(mysql_error());

 

That's how I'd do it any way, assuming the value of $_POST['Type'] will be equal to the name of a field.