Member Avatar for GlenRogers

I have a simple form to search a table for the search term entered into that form.

$query = $_GET['term'];
$min_length = 1;
if(strlen($query) >= $min_length){
   $query = htmlspecialchars($query);
   $query = mysqli_real_escape_string($link, $query);
}

Here the variable 'query' is the search query posted using the get method from the form.

The query for the database looks like this

$sql=mysqli_query($link, "SELECT COUNT(id) FROM products WHERE `name` LIKE 
'%".$query."%' OR `brand` LIKE '%".$query."%'
OR `description` LIKE '%".$query."%' OR `spec` LIKE '%".$query."%'
OR `category` LIKE '%".$query."%' OR `subcategory` LIKE '%".$query."%' AND status = 1 
ORDER BY id DESC") OR die(mysqli_error($link));

So this works ok if I dont paginate results, but I need to paginate them.

I think I need to get this line of code to send the query to each paginated page.

echo " <a href='{$_SERVER['PHP_SELF']}?$sql¤tpage=$x'>$x</a> ";

This gives me this error

'Catchable fatal error: Object of class mysqli_result could not be converted to string'

'$x' is just the variable for the current page

Can anyone help?

Thanks for looking

  • 2 Contributors
  • 4 Replies
  • 267 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by GlenRogers

Dani AI

Generated

Two separate issues are visible in the thread. Echoing the query result object caused the "Object of class mysqli_result could not be converted to string" error (as noted). Wrapping the search logic in if(isset($_GET['submit'])) then prevented results on later pages because the submit button value is not re-sent when clicking a pagination link — the query string should be relied on instead. $_GET holds the query-string values, so test for the presence of the search term rather than the submit button. (php.net)

Preserve the search term (and any other GET parameters) when building pagination links. http_build_query() will encode parameters correctly, so merge the current $_GET with the new page number before outputting the link. Also escape $_SERVER['PHP_SELF'] for HTML output to avoid XSS:

$qs = http_build_query(array_merge($_GET, ['page' => $x]));
echo '<a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '?' . $qs . '">' . $x . '</a>';

http_build_query() is the safe way to build the query string; htmlspecialchars() is for HTML-escaping output. (php.net)

For database safety and predictability, switch to prepared statements rather than relying only on mysqli_real_escape_string(). Use a prepared statement and bind a %term% value for LIKE searches (this example uses a single column; apply the same pattern for multiple columns):

$term = $_GET['term'] ?? '';
$like = "%{$term}%";
$stmt = $mysqli->prepare("SELECT COUNT(id) FROM products WHERE name LIKE ? AND status = 1");
$stmt->bind_param('s', $like);
$stmt->execute();
$stmt->bind_result($count);
$stmt->fetch();

Prepared statements prevent injection better than manual escaping. If keeping a submit-guard for workflow reasons, include the submit flag in the link (merge it into $_GET) or, more simply, check isset($_GET['term']) instead. (php.net)

Recommended Answers

All 4 Replies

Member Avatar for jstfsklh211

your $sql variable is your mysqli obj
most likely you meant to use $query in your url

Member Avatar for GlenRogers

if i use $query then all but the first page are blank, no results!

Member Avatar for GlenRogers

I'm still stuck with this if anyone can help?

Thanks

Member Avatar for GlenRogers

Sorted (I think)

I had everything wrapped in a

if(isset( $_GET['submit'] ) ){
}

So it appears to me that when I went to any other page but the first page (the first time) that submit from my search form wasn't being posted again obviously, so there were no results to get.

When I took that 'if' out the pagination works. But is it ok not to have it?

Thanks

Edited by GlenRogers
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.