Re: [PHP-DB] PHP Results on multiple pages

Tariq Ismail Dalvi wrote:
> Hello Chris,
> 
> I am inserting complete script for you to have a look at and was using
> $s = $pages
> 
>  // Get the search variable from URL
> 
>  $var = @$_GET['q'] ;
>  $trimmed = trim($var); //trim whitespace from the stored variable
> 
> // rows to return
> $limit=10;
> 
> 
> // check for an empty string and display a message.
> 
> if ($trimmed == "")
>  {
>  echo "<p>Please enter a search...</p>";
>  exit;
>  }
> 
> // check for a search parameter
> if (!isset($var))
>  {
>  echo "<p>We dont seem to have a search parameter!</p>";
>  exit;
>  }

I'd change that to:

if (!isset($_GET['q'])) {
   echo "Search for something - or some other error message";
   exit;
}

$search_term = trim($_GET['q']);


> // Build SQL Query
> $query = "select * from mytable where massage like '%".$trimmed."%' 
> order by
> id";

You have sql injection here. You need to use mysql_real_escape_string:

$query = "select * from table where message like '%" . 
mysql_real_escape_string($search_term) . "%'";

> 
> $numresults=mysql_query($query);
> $numrows=mysql_num_rows($numresults);
> 
> 
> // If we have no results, offer a google search as an alternative
> 
> if ($numrows == 0)
>  {
> 
>  echo "<h4>Results</h4>";
>  echo "<p>Sorry, your search: &quot;" . $trimmed . "&quot; returned zero
> results</p>";
> 
> }

You have an xss injection problem here. You need to use htmlentities or 
htmlspecialchars when you display user supplied input:

echo "Your search for &quot;" . htmlspecialchars($trimmed) . "&quot; 
returned no results";
exit;

> // next determine if s has been passed to script, if not use 0
>  if (empty($s)) {
>  $s=0;
>  }
> // get results
>  $query .= " limit $s,$limit";
>  $result = mysql_query($query) or die("Couldn't execute query");

You're re-running your query - this time with a limit.

The first query should either be a 'COUNT' (so it doesn't actually 
retrieve all the results and return them it just does a count), or if 
this is a mysql specific query (and will only ever be), possibly use 
their special 'SQL_CALC_ROWS_FOUND' function (search 
http://dev.mysql.com for it).

If it's a count, the first part will be something like:
$query = "select count(message_id) AS message_count from table where 
message like '%" . mysql_real_escape_string($search_term) . "%'";
$results = mysql_query($query);
$row = mysql_fetch_assoc($results);
$messages_found = $row['message_count'];

Then run your actual search query with the limit so you only fetch 10 
results.

> // display what the person searched for
> echo "<p>You searched for :<font color=blue size=+2> &quot;" . $var .
> "&quot;</font>";

XSS issue here again.


 From here, rewrite it so it's a little easier to follow (and please use 
variable names that make sense! $s and $q do not).

// work out pagination
// number_of_pages will be:
// $messages_found / $number_of_results_per_page

$number_of_pages = $messages_found / $number_of_results_per_page;

$current_page = 0;
if (isset($_GET['page'])) {
   $current_page = (int)$_GET['page'];
}

// if we're on page 0, don't show a prev link
// if it's less than 0, someone is trying to be nasty!
if ($current_page > 0) {
   echo '<a href="' . $_SERVER['PHP_SELF'] . '?q=' . $search_term . 
'&page=' . ($current_page - 1) . '>Prev</a>';
}

// if we're not on the last page, show a next link
if ($current_page < $number_of_pages) {
   echo "Next link here";
}

-- 
Postgresql & php tutorials
http://www.designmagick.com/