error on php exact search with multiple options - php

Question

I'd like to create "Exact Search" with multiple options but the answer says "Could not search".
In the table, price, one and pre are rows.
If the answer matches one and pre, the separated price will be come out. If not, the reply will be "Try agian".
Edited : I have three tables - pre, one and price.
- KA 1 will win 100
- KA 5 will win 500
- MA 3 will win 100
- MA 1 will win 200
- BA 3 will win 800
Edited : I changed the code now and no error shown but the result was always 'Try Again'.
<?php
$output = NULL;
$link = mysqli_connect("localhost","root","","searchdemo") or die("Unable to select database" . mysqli_error($link));
if(isset($_GET['search'])){
$searchq = $_GET['search'];
$searchq = preg_replace("#[^0-9a-z]#i","",$searchq);
$query = mysqli_query ($link, "SELECT * FROM `345` WHERE pre = '$searchq' AND one = '$searchq'") or die("<b>Error</b> : ".mysqli_error($link));
$count = mysqli_num_rows($query);
if ($count == 0){
$output = 'Try Again';
}else{
while($row = mysqli_fetch_array($query)){
$onen = $row['one'];
$pren = $row['pre'];
$price = $row['price'];
$output = 'You won '.$price.' now';
}
}
}
?>
<form name="search1" action="index.php" method="GET">
<b>Prefix</b>
<select name="pre">
<option value="">Pick a prefix</option>
<option value="Ka">Ka</option>
<option value="Ba">Ba</option>
<option value="Ma">Ma</option>
</select>
<b>Number</b>
<select name="one">
<option value="">Pick a number</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
</select>
<input type="submit" name="search" value="Search" />
</form>
<?php
print ("$output");
//echo ($output);
?>

Answer 1

If die() is called, it means that the query failed, so I'd start looking for a reason there.
You are missing WHERE in your query, it should start with
SELECT * FROM 345 WHERE ...
Keep in mind that your code is open for SQL injecion attack. You must to escape all user input that gets into your query.
Simplest way to do it is to use http://php.net/manual/en/function.mysql-real-escape-string.php (deprecated since PHP 5.5) or http://php.net/manual/en/mysqli.real-escape-string.php. You could also use PDO prepared statements for your queries (http://php.net/manual/en/book.pdo.php)

Answer 2

Some general pointers for you here:
You need a WHERE clause in your SQL statement to define the criteria of your search. The search will work without it but it will return everything, which is not what you want. (This has already been fixed)
You need a AND or an OR statement between your variables, in your WHERE clause, because you are asking "show this WHERE condition1 is true AND/OR condition2 is true"
Replace your die command with a better and more informative feedback:
This will output why the search failed. Use this to fix further errors.
or die("Could not search: ".mysql_error());
As mentioned by jedrzej.kurylo, you are wide open for injection attacks on your database and it is very important to fix these, either as they suggest or by upgrading your code to using MySQLi or PDO . Do this now while you're still learning the basics of SQL because it's far better than getting into the bad habit of using old, deprecated and insecure MySQL.

Answer 3

Finally I got the answer and that was so easy. What a dumb I am! :)
I do really thanks to #Martin and #jedrzej.kurylo
<?php
$output = NULL;
$link = mysqli_connect("localhost","root","","searchdemo") or die("Unable to select database" . mysqli_error($link));
if(isset($_POST['search'])){
$spre = $_POST['pre'];
$sone = $_POST['one'];
$query = mysqli_query ($link, "SELECT * FROM `345` WHERE pre = '$spre' AND one = '$sone'") or die("<b>Error</b> : ".mysqli_error($link));
$count = mysqli_num_rows($query);
if ($count == 0){
$output = 'Try Again';
}else{
while($row = mysqli_fetch_array($query)){
extract($row);
$onen = $row['one'];
$pren = $row['pre'];
$price = $row['price'];
$id = $row['id'];
$output = 'You won '.$price.' now';
}
}
}
?>
<form name="search1" action="index.php" method="POST">
<b>Prefix</b>
<select name="pre">
<option value="">Pick a prefix</option>
<option value="Ka">Ka</option>
<option value="Ba">Ba</option>
<option value="Ma">Ma</option>
</select>
<b>Number</b>
<select name="one">
<option value="">Pick a number</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
</select>
<input type="submit" name="search" value="SEARCHING" />
</form>
<?php
print ("$output <br />");
?>