This question already has an answer here:
Alright, I have created a simple PHP search and all of it is working with the database, however I have realised my code is SQL injectable due to an error.
Index (Start page):
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Helpy Search Engine</title>
</head>
<body>
<h1>Go ahead, search.</h1>
<form action="results.php" method="get">
<input type="text" name="query" placeholder="Search..">
<button type="submit">Search</button>
</form>
</body>
</html>
Results page (Displays search results.)
<?php
$search = $_GET['query'];
mysql_connect("localhost", "My username for DB", "My password for DB") or die(mysql_error());
mysql_select_db("filthysl_search");
$query = mysql_query("SELECT * FROM results WHERE title LIKE '%".$search."%'");
if(mysql_num_rows($query) >= 1) {
while($a = mysql_fetch_array($query)) {
echo "<a href='".$a['url']."'>".$a['title']."</a><p>".$a['description']."</p><hr/>";
}
} else {
echo "Oh no! Nothing was found.";
}
?>
The Error I am getting (On Results page):
Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home2/filthysloth/public_html/results.php on line 9
Thanks for any help !
Aucun commentaire:
Enregistrer un commentaire