MYSQL Query Error Every Time - php

Question

I am attempting to use a drop-down list to pull Pokémon info back from a database that I've uploaded, and I keep getting the following error:
No Pokemon was requestedDatabase access failed: You have an error in
your SQL syntax; check the manual that corresponds to your MySQL
server version for the right syntax to use near 'WHERE pokemon_name =
SELECT * FROM pokemon_info' at line 1
I have a database currently with the headings:
id | pokemon_name | height | weight | gif
I literally can't figure out why... My processing code is as follows;
// CODE TO QUERY DATABASE TO GO HERE
// Capture form data, if anything was submitted
if (isset($_POST['pokemon_submit'])) {
$pokemon_submit = clean_string($db_server, $_POST['submit']);
// create the SQL query
$query = "SELECT * FROM pokemon_info where pokemon_info=$pokemon_submit";
// query the database
mysqli_select_db($db_server, $db_database);
$result = mysqli_query($db_server, $query);
if (!$result) die("Database access failed: " . mysqli_error($db_server));
// if there are any rows, print out the contents
if ($row = mysqli_fetch_array($result)) {
$output .= "Pokemon: " . $row['pokemon_name'] . ", Gif: " .
$row['gif'] . "<br />";
}
else {
$output = 'Well, you must have invented a new Pokémon, cause it is not on this website!';
}
mysqli_free_result($result);
}
else {
$output = 'No Pokemon was requested';
}
// CODE TO QUERY END
}
// Close connection!
// YOUR CODE HERE BIT end
echo $output;
$output = '';
mysqli_select_db($db_server, $db_database);
$query = "WHERE pokemon_name = $pokemon_submit SELECT * FROM pokemon_info";
$result = mysqli_query($db_server, $query);
if (!$result) die("Database access failed: " . mysqli_error($db_server));
while($row = mysqli_fetch_array($result)){
$output .= "Pokemon: " . $row['pokemon_name'] . ", Gif: " .
$row['gif'] . "<br />";
}
mysqli_free_result($result);
echo $output;
I have now amended thanks to your help, and it's saying that no Pokémon was requested.
The basic idea of this is to have a main page with a drop-down list of pokemon. When a user selects from the list, the information stored in my database about that specific pokemon is displayed.
The drop-down list is linked directly to the pokemon_name column in my database. I don't understand why it's coming back as though nothing is selected?
Thank you all SO much for your help, I'm learning much more here than trawling through forums.

Answer 1

There are more than one issue(s)
$query = "SELECT * FROM pokemon_info where pokemon_name=$pokemon_submit";
if pokemon_submit is a number - it is ok. If it is a string then you need
$query = "SELECT * FROM pokemon_info where pokemon_name='$pokemon_submit'";
notice the single quotes.
$query = "WHERE pokemon_name = $pokemon_submit SELECT * FROM pokemon_info";
$result = mysqli_query($db_server, $query);
I have no clue what you're trying here? I know of no SQL statements begin with "WHERE"

Answer 2

WHERE pokemon_name = $pokemon_submit SELECT * FROM pokemon_info
is not a valid query.
If you want to select the pokemon $pokemon_submit from pokemon_info, what you do is this;
SELECT * FROM `pokemon_info` WHERE `pokemon_name` = '$pokemon_submit'
The WHERE comes after SELECT. More on the doc page.
I'd also look into verifying data before putting it into the query, OOP approach to MySQLi and general SQL syntax.

Answer 3

I urge you to look at the other comments. Your querying looks fundamentally unsafe. However, I believe that your actual issue is here:
if (isset($_POST['pokemon_submit'])) {
$pokemon_submit = clean_string($db_server, $_POST['submit']);
First, you look for $_POST['pokemon_submit'], but when you clean the string, you use $_POST['submit'].

Answer 4

Insted of WHERE pokemon_name = $pokemon_submit SELECT * FROM pokemon_info try altering your query to something like ...
WHERE pokemon_name in $pokemon_submit SELECT pokemon_name FROM pokemon_info
The second part of your query is returning multiple results. ie..... Select * from pokemon_info.
So we refine that to get only the pokemon names back ie..
select pokemon_name from pokemon_info
And the first part of the query will only want names where the name matches any of the results from the second part of the query
Your full query should look something like
select * from pokemon_info WHERE pokemon_name in $pokemon_submit SELECT pokemon_name FROM pokemon_info
or in short
select * from pokemon_info where pokemon_name = $pokemon_submit