CODEWITHSUNDEEP
phpdatabase
JasonCDenson
JasonCDenson

Reputation: 3

database connection issues

I am trying to link my website to my database for the results but it shows these errors:

Warning: mysql_select_db() expects parameter 1 to be string, resource given in C:\wamp\www\SearchEngine\connect.php on line 9

and

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in C:\wamp\www\SearchEngine\search.php on line 44

These are the codes for those 2 files:

connect.php:

<?php

$con = mysql_connect("localhost", "root", "");
if (!$con)
{
    echo "Cannot connect to database";
    die();
}
mysql_select_db($con,"SearchEngine");

?>

search.php:

<?php
//php code goes here
include 'connect.php'; // for database connection
$query = $_GET['q'] // query
?>
<html>
    <head>
        <title>
            Brandon's Search Engine
        </title>
        <style type="text/css">
            #search-result {
                font-size: 22;
                margin: 5px;
                padding: 2px;
            }
            #search-result:hover {
                border-color: red;
            }
        </style>
    </head>
    <body>
        <form method="GET" action="search.php">
            <table>
                <tr>
                    <td>
                        <h2>
                            Brandon's Search Engine
                        </h2>
                    </td>
                </tr>
                <tr>
                    <td>
                        <input type="text" value="<?php echo $_GET['q']; ?>" name="q" size="80" name="q"/>
                        <input type="submit" value="Search" />
                    </td>
                </tr>
                <tr>
                    <td>
                        <?php
                        //SQL query
                        $stmt = "SELECT * FROM web WHERE title LIKE '%$query%' OR link LIKE '%$query%'";
                        $result = mysql_query($stmt);
                        $number_of_result = mysql_num_rows($result);
                        if($number_of_result < 1)
                            echo "Your search did not match any documents. Please try different keywords.";
                        else
                        {
                                //results found here and display them
                                while($row = mysql_fetch_assoc($result))
                                {
                                    $title = $row["title"];
                                    $link = $row["link"];
                                    echo "<div id='search-result'>";
                                    echo "<div id='title'" . $title . "</div>";
                                    echo "<br />";
                                    echo "<div id='link'" . $link . "</div>";
                                    echo "</div>";
                                }
                        }
                        ?>
                    </td>
                </tr>
            </table>
        </form>
    </body>
</html>

If possible, please explain to me.

Upvotes: 0

Views: 108

Answers (5)

user3032696
user3032696

Reputation:

I can see your error and its supposed to be like this

mysql_select_db("SearchEngine",$con);

Upvotes: 1

user7789076
user7789076

Reputation: 798

First Parameter must be database name

mysql_select_db("SearchEngine",$con);

¨

Upvotes: 0

Chris Wheeler
Chris Wheeler

Reputation: 1726

You have the parameters the wrong way around, it should be

mysql_select_db("SearchEngine",$con);

Your script is also insecure, you should do the following:

  • Use mysqli_* methods instead of mysql_* if available, e.g:

$con = mysqli_connect("localhost", "root", ""); mysqli_select_db($con,"SearchEngine");

etc.

  • Escape the query parameter before using it in any Query to prevent SQL Injection, e.g:

Replace

$stmt = "SELECT * FROM web WHERE title LIKE '%$query%' OR link LIKE '%$query%'";

with

$stmt = "SELECT * FROM web WHERE title LIKE '%" . mysqli_real_escape_string($con, $query) . "%' OR link LIKE '%" . mysqli_real_escape_string($con, $query) . "%'";

  • Escape user generated content in HTML to prevent Cross Site Scripting (XSS), e.g:

Replace

<input type="text" value="<?php echo $_GET['q']; ?>" name="q" size="80" name="q"/>

with

<input type="text" value="<?php echo htmlspecialchars($_GET['q']); ?>" name="q" size="80" name="q"/>

Upvotes: 2

Krish R
Krish R

Reputation: 22721

Syntax for mysql database selection,

bool mysql_select_db ( string $database_name [, resource $link_identifier = NULL ] )

Try use ,

mysql_select_db("SearchEngine",$con);

instead of

mysql_select_db($con,"SearchEngine");

Ref: https://www.php.net/mysql_select_db

Note: Try to use mysqli_* functions or PDO instead of mysql_* functions(deprecated)

Upvotes: 2

jszobody
jszobody

Reputation: 28931

That error tells you the first parameter should be a string. If you check the docs, you'll see the database name comes first, then the connection resource.

So do this:

mysql_select_db("SearchEngine",$con);

Also: don't use mysql* functions at all! Switch to mysqli or even better PDO for your database interaction.

Upvotes: 1

Related Questions