need help with search

[that0neguy]

Having a problem and trying to get some help.

 

Im trying to set up a page where user's can enter info and then have it search the sql db and return the results.

 

Here is a copy of the code im using. I beleive the problem to be with the $find.

 

because if I do $data = mysql_query('SELECT * FROM `mastertech` WHERE `Tech` = 7777') ;

It displays the proper results, but when i have as $data = mysql_query('SELECT * FROM `mastertech` WHERE `Tech` = $find') ;

and type in 7777 in the search, it comes back with Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in C:\public_html\MasterTech\search.php on line 35

and Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in C:\public_html\MasterTech\search.php on line 52

 

what I can't figure out is when i echo $find; or echo $_GET[$find] it shows nothing.

 

Any help or guidance would be very appreciated.

 

Thanks,

 

<h2>Search</h2>
<form name="search" method="GET" action="<?=$PHP_SELF?>">
Seach for: <input type="text" name="find" /> in
<Select NAME="field">
<Option VALUE="Tech">Tech #</option>

</Select>
<input type="submit" name="Search" value="Search" />
</form>

<?

echo "<h2>Results</h2><p>";

//If they did not enter a search term we give them an error
if ($_GET[($find == "")])
{
echo "<p>You forgot to enter a search term";
exit;
} 

// Otherwise we connect to our Database
mysql_connect("login info") or die(mysql_error());
mysql_select_db("mastertech") or die(mysql_error());

// We preform a bit of filtering


//Now we search for our search term, in the field the user specified
$data = mysql_query('SELECT * FROM `mastertech` WHERE `Tech` = $find') ;



//And we display the results
while ($result = mysql_fetch_array($data))
{
echo $result['Tech'];
echo "<br>";
echo $result['Mobile'];
echo "<br>";
echo $result['Name'];
echo "<br>";
echo "<br>";
echo "You Searched for: ";
echo $find;

}

//This counts the number or results - and if there wasn't any it gives them a little message explaining that
$anymatches=mysql_num_rows($data);
if ($anymatches == 0)
{
echo "Sorry, but we can not find an entry to match your query<br><br>";


//And we remind them what they searched for
echo "<b>Searched For:</b> " .$find;
}
?>

[mikefrederick]

set this: $find=$_GET['find']; not $find=$_GET[$find];

[soycharliente]

Make sure that you are escaping the data as well. It might not be a good idea to place text from the box straight into a query without making sure it's "safe" first.

[that0neguy]

That worked. had to clean up the sql query also.

 

$data = mysql_query("SELECT * FROM mastertech WHERE Tech ='$find'");



//And we display the results
while ($result = mysql_fetch_array($data))
{
echo $result['Tech'];
echo "<br>";
echo $result['Mobile'];
echo "<br>";
echo $result['Name'];
echo "<br>";
echo "<br>";
echo "You Searched for: ";
echo $find;

 

working now.

 

Thanks