User Driven Queries in PHP

[stublackett]

Hi,

 

I'm looking to 'search' my database to find data that corresponds to the field the user has searched

 

Its down to the SELECT query, I believe which is not executing the text inputted into the box

 

The code is as follows :

^{<form action="" method="get" name="find" id="find">}

    ^<fieldset>

      ^{<legend>Search Users....</legend>}

      ^<div>

      ^{<label for="firstname">First Name</label>}

      ^{<input type="text" name="firstname" id="firstname" class="txt" />}

      ^{<input type="submit" value="Show Users">}

    ^</div>

    ^</form>

 

^<?php

 

^{$hostname = "localhost";}

^{$db_user = "root";}

^{$db_password = "";}

^{$dbname = "test";}

^{$db_table = "dummydata";}

^{$db = mysql_connect($hostname, $db_user, $db_password);}

^{mysql_select_db($dbname,$db);}

 

^{$selection = $_GET['firstname'];}

 

^{if(! $db )}

^{

  ^{die('Could not connect: ' . mysql_error());}

^}

^{$sql = 'SELECT * FROM dummydata WHERE "$selection"';}

 

^{mysql_select_db('dummydata');}

^{$retval = mysql_query( $sql, $db );}

^{if(! $retval )}

^{

  ^{die('Could not get data: ' . mysql_error());}

^}

^{while($row = mysql_fetch_array($retval, MYSQL_NUM))}

^{

    ^{echo "firstname :{$row[0]}  <br> ".}

        ^{"secondname : {$row[1]} <br> ".}

        ^{"--------------------------------<br>";}

^}

^{mysql_free_result($retval);}

^{echo "These are the users you found in the Database";}

^?>

 

 

I've echoed the $sql and it says "DBSELECT * FROM dummydata WHERE "$selection"All

All being the search title I put into my DB

 

Any idea how to get this to replace all with the $selection ?

 

 

[revraz]

Variables in strings require double quotes.

 

$sql = "SELECT * FROM dummydata WHERE username='$selection'";

 

You also forgot the field name to compare to.  And if you want to search for say Rob and have it return Rob and Robert, then you need to use LIKE as well as % wildcard.