Protecting Web Form From Showing Data From Database

[arshad_1318]

Well, First Of All Im A New Bee To Php . I've Just Started With It. I've Been Wondering How A Web Form Actually Posts Data Back From A Database. I've Found Several Online Resources And Atlast i've Suceeded In Making One Searchable Database At:

 

http://www.intl.in/search/

 

 

Everythings Just Working Fine. When i Click a Name Like Bob It Return Backs With Data. But When I Click The Web page Directly It Shows Off All The Data Present in Database Table . Like This:

 

http://www.intl.in/search/search.php

 

The Code I've Used Is

<?php
$host_name = "localhost";
$user_name = "";
$password = "";
$db_name = "";

mysql_connect("$host_name" , "$user_name" , "$password");
mysql_select_db("$db_name");

$term = $_POST['term'];


$sql = "SELECT * FROM resultstable WHERE FName like '%$term%' or LName like '%$term%'";
$query = mysql_query($sql) or die("Error: " . mysql_error() . "<br />In Query: " . $sql);


while ($row = mysql_fetch_array($query)){
    echo 'ID: '.$row['ID'];
    echo '<br/> First Name: '.$row['FName'];
    echo '<br/> Last Name: '.$row['LName'];
    echo '<br/> Phone: '.$row['Phone'];
    echo '<br/><br/>';
    }

?>

And I've Always Been Wondering How School Results Are Declared Like In This Website

 

http://results.bharatstudent.com/ssc-results-2012-10th-class-results.php

 

For Example If I Enter An ID Like 1236143276 It Returns Back With Results In Seconds

 

 

We've Actually Been Planning To Host Our School Results Online. Can Some One here With free Time can help us Do it.

 

I would appreciate any help over here.

 

Thanking You,

 

Regards & Wishes,

Arshad Mohammed

Edited April 16, 2013 by arshad_1318

[Rifts]

while ($row = mysql_fetch_array($query)){
    echo 'ID: '.$row['ID'];
    echo '<br/> First Name: '.$row['FName'];
    echo '<br/> Last Name: '.$row['LName'];
    echo '<br/> Phone: '.$row['Phone'];
    echo '<br/><br/>';
    }

These are the lines which are actually displaying that data from your database.

[lemmin]

When no search term is specified, your query looks like this:

SELECT * FROM resultstable WHERE FName like '%%' or LName like '%%'

This matches EVERY Fname and LName, hence the dump of your data.

 

If you don't want to allow this, you can simply validate the term string:

if (!$term)
   die(); //Or skip over your querying

[arshad_1318]

Any Suggestions? on how To Create a Form Like in http://results.bharatstudent.com/ssc-results-2012-10th-class-results.php

[Q695]

Put the data in a form, and use post, then use $_POST to pull the data for where you want to send it to, then mnipulate the data as you want it manipulated.