beginner- return query with user input

[iulo0566]

Hello.  I'm very new to php, and I'm running into the same problem over and over.  I'm trying to get info from a database based on a variable (user defined).  I've been testing this on Earthlink.net and also on inmotionhosting.com, but don't know what I'm missing.  Any help would be greatly appreciated.

 

Here is the search section of the code (not sure what other info you'll need to help me out):

if ($searchtype || $searchterm) {

$query = 'SELECT * FROM `rawmaterials` WHERE `$searchtype` LIKE `$searchterm` ';

 

$result = mysql_query($query) or DIE("Could not Execute Query on table $usertable. ");

echo '<table border="1">';

while ($row = mysql_fetch_array($result)) {

 

echo '<tr><td colspan="2"><strong>Trade Name: </strong>'.'<br />';

echo $row['trade_name'].'<br />';

        echo '<strong>Code #: </strong>'.$row['code_num'].'<br />';

      echo '<strong>INCI Name: </strong>'.'<br />';

        echo $row['INCI_name'].'<br />';

        echo '<strong>Usage Levels: </strong>'.$row['usage_levels'].'<br />';

        echo '<strong>Platform: </strong>'.$row['platform'].'<br />';

echo '</td>';

      echo '<td colspan="4"><strong>Description: </strong>'.'<br />';

      echo $row['description'].'<br />';

      echo '</td>';

      echo '</tr>';

}

      echo '</table>';

[rhodesa]

first thing i notice is this:

      $query = 'SELECT * FROM `rawmaterials` WHERE `$searchtype` LIKE `$searchterm` ';

should be

      $query = "SELECT * FROM `rawmaterials` WHERE `$searchtype` LIKE '$searchterm'";

to make it syntactically correct...depending on what your logic is, it may need more changes

 

also, when debugging, use mysql_error() to see what is wrong:

      $result = mysql_query($query) or DIE("Could not Execute Query on table $usertable: ".mysql_error());

[ignace]

also, when debugging, use mysql_error() to see what is wrong:

      $result = mysql_query($query) or DIE("Could not Execute Query on table $usertable: ".mysql_error());

 

It is very important that you only use 'or die()' during debugging never ever use it in a production environment your visitors don't know what: "Could not Execute Query on table SomeTable: Query was empty" means. Always display a nicer message telling them what happened and what they can do next.

[iulo0566]

thank you both.

 

i changed the two lines of code you suggested, and the error i'm getting is " Unknown column 'aloe' in 'where clause"

 

"aloe" was the $searchterm.  not sure what to do, or why the error refers to "aloe" as a column

[rhodesa]

after

      $query = "SELECT * FROM `rawmaterials` WHERE `$searchtype` LIKE '$searchterm'";

if you do

echo $query;

what is the output?

[iulo0566]

SELECT * FROM `rawmaterials` WHERE `platform` LIKE `extraction`Could not Execute Query on table rawmaterials: Unknown column 'extraction' in 'where clause'

[rhodesa]

you haven't updated this line:

      $query = "SELECT * FROM `rawmaterials` WHERE `$searchtype` LIKE '$searchterm'";

there needs to be single quotes around the $searchterm...not backticks

[iulo0566]

o my goodness!  it works!!!!!!!!!! 

i can't thank you enough!