Member Avatar for Siboneloz

Hi All,

im having a problem with searching a database in dreamweaver and was wondering if anyone here has tried it? its a mysql database. here is the situation. i have DB called real_db with a table in i call listings. i want to be able to search the db and display results on a page... so far its not working... it shows me everything BUT the results i want. if anyone has moment to review my code and make suggestions i would GREATLY appreciate it

<?php
	require_once('auth.php');
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
<style type="text/css">
@import url("images/style.css");
#apDiv2 {
	position:absolute;
	width:437px;
	height:43px;
	z-index:1;
	text-align: center;
	left: 8px;
	top: 45px;
}
#apDiv3 {
	position:absolute;
	width:417px;
	height:42px;
	z-index:2;
	left: -82px;
	top: 3px;
	text-align: center;
}
#apDiv {	position:absolute;
	width:504px;
	height:211px;
	z-index:1;
	left: 2px;
	top: 106px;
	text-align: right;
}
#apDiv4 {	position:absolute;
	width:313px;
	height:20px;
	z-index:3;
	left: 191px;
	top: 148px;
}
#apDiv5 {
	position:absolute;
	width:438px;
	height:362px;
	z-index:2;
	top: 95px;
	left: 10px;
}
</style>
</head>

<body>
<div class="titletext" id="apDiv2">Search listings</div>
<div id="apDiv5">
  <form id="form1" name="form1" method="get" action="/realwww/searchhouse.php">
    <table width="313" height="303" align="center">
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Sale type:</td>
        <td><select name="sale_type">
          <option value="Residential" <?php if (!(strcmp("Residential", ""))) {echo "SELECTED";} ?>>Residential</option>
          <option value="Commercial" <?php if (!(strcmp("Commercial", ""))) {echo "SELECTED";} ?>>Commercial</option>
          <option value="Land" <?php if (!(strcmp("Land", ""))) {echo "SELECTED";} ?>>Land</option>
          <option value="Farm" <?php if (!(strcmp("Farm", ""))) {echo "SELECTED";} ?>>Farm</option>
          <option value="New Developments" <?php if (!(strcmp("New Developments", ""))) {echo "SELECTED";} ?>>New Developments</option>
        </select></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Home type:</td>
        <td><select name="home_type">
          <option value="House" <?php if (!(strcmp("House", ""))) {echo "SELECTED";} ?>>House</option>
          <option value="Cluster" <?php if (!(strcmp("Cluster", ""))) {echo "SELECTED";} ?>>Cluster</option>
          <option value="Apartment" <?php if (!(strcmp("Apartment", ""))) {echo "SELECTED";} ?>>Apartment</option>
          <option value="Duplex" <?php if (!(strcmp("Duplex", ""))) {echo "SELECTED";} ?>>Duplex</option>
          <option value="Simplex" <?php if (!(strcmp("Simplex", ""))) {echo "SELECTED";} ?>>Simplex</option>
        </select></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Price:</td>
        <td><input type="text" name="Price" value="" size="32" /></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Bedrooms:</td>
        <td><select name="Bedrooms">
          <option value="0" <?php if (!(strcmp(0, ""))) {echo "SELECTED";} ?>>0</option>
          <option value="1" <?php if (!(strcmp(1, ""))) {echo "SELECTED";} ?>>1</option>
          <option value="2" <?php if (!(strcmp(2, ""))) {echo "SELECTED";} ?>>2</option>
          <option value="3" <?php if (!(strcmp(3, ""))) {echo "SELECTED";} ?>>3</option>
          <option value="4" <?php if (!(strcmp(4, ""))) {echo "SELECTED";} ?>>4</option>
          <option value="5" <?php if (!(strcmp(5, ""))) {echo "SELECTED";} ?>>5+</option>
        </select></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Bathrooms:</td>
        <td><select name="bathrooms">
          <option value="1" <?php if (!(strcmp(1, ""))) {echo "SELECTED";} ?>>1</option>
          <option value="2" <?php if (!(strcmp(2, ""))) {echo "SELECTED";} ?>>2</option>
          <option value="3" <?php if (!(strcmp(3, ""))) {echo "SELECTED";} ?>>3</option>
          <option value="4" <?php if (!(strcmp(4, ""))) {echo "SELECTED";} ?>>4+</option>
        </select></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Number:</td>
        <td><input type="text" name="number" value="" size="32" /></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Street address:</td>
        <td><input type="text" name="street_address" value="" size="32" /></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Suburb:</td>
        <td><input type="text" name="suburb" value="" size="32" /></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">Province:</td>
        <td><select name="province">
          <option value="Eastern Cape" <?php if (!(strcmp("Eastern Cape", ""))) {echo "SELECTED";} ?>>Eastern Cape</option>
          <option value="Free State" <?php if (!(strcmp("Free State", ""))) {echo "SELECTED";} ?>>Free State</option>
          <option value="Gauteng" <?php if (!(strcmp("Gauteng", ""))) {echo "SELECTED";} ?>>Gauteng</option>
          <option value="Kwa-Zulu Natal" <?php if (!(strcmp("Kwa-Zulu Natal", ""))) {echo "SELECTED";} ?>>Kwa-Zulu Natal</option>
          <option value="Limpopo" <?php if (!(strcmp("Limpopo", ""))) {echo "SELECTED";} ?>>Limpopo</option>
          <option value="Mpumalanga" <?php if (!(strcmp("Mpumalanga", ""))) {echo "SELECTED";} ?>>Mpumalanga</option>
          <option value="North West" <?php if (!(strcmp("North West", ""))) {echo "SELECTED";} ?>>North West</option>
          <option value="Northern Cape" <?php if (!(strcmp("Northern Cape", ""))) {echo "SELECTED";} ?>>Northern Cape</option>
          <option value="Western Cape" <?php if (!(strcmp("Western Cape", ""))) {echo "SELECTED";} ?>>Western Cape</option>
        </select></td>
      </tr>
      <tr valign="baseline">
        <td nowrap="nowrap" align="right">&nbsp;</td>
        <td><input type="submit" value="Search" /></td>
      </tr>
    </table>
  </form>
</div>
<div id="apDiv3">
  <div id="submenu">
    <div class="smallgraytext" style="padding: 9px; text-align: right;" align="right"><a href="/realwww/newlisting.php" target="mainFrame">Create new listing</a> <img src="images/bg_menu.gif" width="2" height="20" alt="break" /><a href="/realwww/searchlisting.php"> Search listings </a><img src="images/bg_menu.gif" width="2" height="20" alt="" /> <a href="/realwww/view listings.php" target="mainFrame">View your listings </a><img src="/realwww/images/bg_menu.gif" width="2" height="20" alt="" /> <a href="/realwww/updatelisting.php" target="mainFrame">Edit listings</a></div>
  </div>
</div>
</body>
</html>

whoa i didnt realise how long it was... lol.

  • 2 Contributors
  • 2 Replies
  • 635 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Siboneloz

Dani AI

Generated

Short, practical update tied to the original posts by and .

The symptom “search returns everything” almost always means the query never gets a usable WHERE clause (either the script sees empty inputs, the form field names don’t match the code, or the server-side code builds the SQL incorrectly). Start by verifying which inputs actually arrive (inspect the query string or dump the superglobal). For safe input handling prefer the filter family rather than trusting raw globals. (php.net)

Instead of the old ext/mysql pattern, use parameterized queries (PDO or mysqli) and build the WHERE clause only from non-empty fields. Prepared statements prevent SQL injection and make dynamic filters straightforward; the official PDO and mysqli docs show the recommended patterns. (php.net)

A compact server-side workflow that fixes the common gaps:

  • Confirm form method/action and that input name values match the server code.
  • Sanitize/validate each incoming value (use filter_input() or equivalent).
  • Collect non-empty filters into an array, join them with AND, and bind parameters with PDO or mysqli.
  • Echo the final SQL or parameter list only for local debugging (never in production).

Example (conceptual) PDO pattern:

// collect non-empty filters into $wheres and $params, then:
$sql = 'SELECT * FROM listings' . ($wheres ? ' WHERE ' . implode(' AND ', $wheres) : '');
$stmt = $pdo->prepare($sql);
$stmt->execute($params);
$rows = $stmt->fetchAll();

Security note: the old mysql extension was deprecated and removed from modern PHP; migrating to PDO/mysqli is the correct long-term change. Also follow the OWASP guidance: stop building queries by concatenating raw input—use prepared statements and allow-list validation where possible. (wiki.php.net)

If the form still returns all rows, add a quick var_dump($_GET)/filter_input() trace to confirm which fields are non-empty and that the server-side names match the form controls. That little trace usually shows the mismatch that leads to a missing WHERE clause. (php.net)

Member Avatar for Siboneloz

awesome, i think i have it sorted thanks to your links.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.