While Loop Not Working

[supanoob]

I have the following code, and it is not working for some reason. I have echoed the $sql and that it showing fine, then its not showing as any results etc when i echo them, any idea why it may be?

if ($_GET['step'] == 'search' && $_GET['action'] == 'submit')
{

$search = $_POST['searchcriteria'];
$searchtype = $_POST['search'];

if ($search == '')
{
echo "No search criteria entered.";
die();
}

  $sql="SELECT  userid, firstname, secondname, day, month, year, postcode FROM users WHERE $searchtype LIKE $search"; 
	//-run  the query against the mysql query function 
  echo "$sql";
	$result=mysql_query($sql); 
  echo "<br><br>result:$result<br>";
	//-count  results 
	$numrows=mysql_num_rows($result);
  echo "rows found: $numrows<br>"; 
	echo  "<p>" .$numrows . " results found for " . $search . "</p>"; 
	//-create  while loop and loop through result set 
	while($row=mysql_fetch_array($result)){ 
	            $firstname=$row['firstname']; 
	            $secondname=$row['secondname']; 
	            $userid=$row['userid'];
              $day=$row['day'];
              $month=$row['month'];
              $year=$row['year'];
              $postcode=$row['postcode']; 
	//-display  the result of the array 
	echo  "<ul>\n"; 
	echo  "<li>$firstname $secondname (DOB: $day/$month/$year) $postcode</a></li>\n"; 
	echo  "</ul>"; 
	} 

} 

Thanks in advance.

[benanamen]

Your code is obsolete, insecure and has been completely removed from Php. It is also vulnerable to SQL Injection. You need to use PDO. https://phpdelusions.net/pdo

[requinix]

The problem is that you've constructed an invalid query. If you use PDO's prepared statements then you won't have that problem.

 

...but it won't be able to do the $searchtype part. You must make sure that it has an acceptable value before you put it into the query. You can do that with code like

if (in_array($_POST['search'], array('firstname', 'secondname'))) {
	$search = $_POST['search'];
} else {
	// either show an error or use a default value for $search
}