CODEWITHSUNDEEP
phpmysql
Jeffrey Murphy
Jeffrey Murphy

Reputation: 23

display database query using form post method

My apologies for being a cut and paste user.

What I am attempting to do is create a basic admin lookup for DB users.

I get no error message fro DB but no results display.

What I am attempting to do is get DB info of a User_ID using form post method from a form where Admin looksup user info based on user ID.

Here is my php

<?php
 $con=mysqli_connect("dbhost","username","password","dbase");
 // Check connection
 if (mysqli_connect_errno()) {
 echo "Failed to connect to MySQL: " . mysqli_connect_error();
 }
 $result = mysqli_query($con,"SELECT 'User_ID', 'Username', 'Email', 'Group_ID' * FROM table
 WHERE User_ID= $User_ID ");
 echo $row['User_ID'] . " " . $row['Username'] . " " . $row['Email']. " " . $row['Group_ID'];
 echo "<br>";
 ?>

I greatly appreciate your assistance

Jeff

Upvotes: 1

Views: 89

Answers (2)

Logan Wayne
Logan Wayne

Reputation: 5991

REMARKS

  • Your using apostrophe (') on your column name, which should not and should only be used on variable/s inside the query. You can use back ticks (`) instead of apostrophe (') on your column name.
  • If you're gonna select the specific column names on your query, you should not include the asterisk (*) along with them.
  • Next is you don't have a fetch loop to get the results.
  • You need to use apostrophe (') when having a variable/s in your condition in your query.
  • Did you assign the submitted input into $User_ID variable?

Right Code: 

<?php

$con=mysqli_connect("dbhost","username","password","dbase");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$result = mysqli_query($con,"SELECT User_ID, Username, Email, Group_ID FROM table
WHERE User_ID= '$User_ID'");

while($row=mysqli_fetch_array($result)){
echo $row['User_ID'] . " " . $row['Username'] . " " . $row['Email']. " " . $row['Group_ID'];
echo "<br>";

} /* END OF WHILE LOOP */

?>

You can also use prepared statement instead to prevent further SQL injections. Here's what it would look like if you had it in prepared statement:

<?php

$con=mysqli_connect("dbhost","username","password","dbase");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

if ($stmt = $con->prepare("SELECT User_ID, Username, Email, Group_ID FROM table WHERE User_ID=?")) {

  $stmt->bind_param("s", $User_ID); /* LETS ASSUME THAT THE SUBMITTED DATA IS STORED INTO $User_ID VARIABLE */

  $stmt->execute();

  $stmt->bind_result($userid,$username,$email,$groupid);

  while ($stmt->fetch()) {
    printf ("%i %s %s %i<br>", $userid,$username,$email,$groupid); /* YOU CAN REPLACE THE NECESSARY STRING FORMAT IF YOU NEED TO */
  } /* END OF WHILE LOOP */

  $stmt->close();
}

$con->close();

?>

Upvotes: 0

Jenz
Jenz

Reputation: 8369

This query have lot of errors:

 $result = mysqli_query($con,"SELECT 'User_ID', 'Username', 'Email', 'Group_ID' * FROM table
 WHERE User_ID= $User_ID ");

1) Undefined variable $User_ID

2) You are using both * and column names in query

3) Use of quotes for columns. Instead you can use backtits.

Change your query to:

 $result = mysqli_query($con,"SELECT `User_ID`, `Username`, `Email`, `Group_ID`  FROM table
     WHERE User_ID= $User_ID ");

Upvotes: 1

Related Questions