Having difficulty in search result in php - php

Question

I am creating a page for students where they can search their result by three different option. i am having problem. Kindly guide me where i am doing mistake
<form action="do_search.php" method="post">
<table width="540" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td height="30"><strong>Search Criteria</strong></td>
<td></td>
<td><label for="criteria"></label>
<select name="criteria" id="criteria">
<option>Seach by Name</option>
<option>Search by Father Name</option>
<option>Search by Roll No.</option>
</select></td>
</tr>
<tr>
<td height="30"> </td>
<td></td>
<td> </td>
</tr>
<tr>
<td width="150" height="30"><strong>Enter Value:</strong></td>
<td width="20"></td>
<td width="370"><input name="value" type="text" id="value" size="40" /></td>
</tr>
<tr>
<td height="10" colspan="3"></td>
</tr>
<tr>
<td height="30"></td>
<td></td>
<td>
<input name="submit" type="submit" value="Submit" id="submit_btn"/>
<input name="reset" type="reset" value="Reset" id="reset_btn" /> </td>
</tr>
<tr>
<td colspan="3" height="10"></td>
</tr>
</table>
</form>
do.search.php
<?php
include 'authentication.php';
include 'includes/dbConnect.php';
?>
<?php
$criteria = $_POST['criteria'];
$value = $_POST['value'];
if ($value == '')
{
$myURL = 'error.php?eType=no_value';
header('Location: '.$myURL);
exit;
}
if ($criteria == "search by name")
{
$result = mysql_query( "SELECT * FROM students WHERE Name = '$value'" ) or die("SELECT Error: ".mysql_error());
$num_rows = mysql_num_rows($result);
}
elseif ($criteria == "search by father name")
{
$result = mysql_query( "SELECT * FROM students WHERE Father_Name = '$value'" ) or die("SELECT Error: ".mysql_error());
$num_rows = mysql_num_rows($result);
}
elseif ($criteria == "search by roll no.")
$result = mysql_query( "SELECT * FROM students WHERE Roll_No. = '$value'" ) or die("SELECT Error: ".mysql_error());
$num_rows = mysql_num_rows($result);
?>
Kindly guide me where i am doing wrong.

Answer 1

Your dropdown values will never have a match since <option>Seach by Name</option> will never match with $criteria == "search by name".
In your form, I suggest do something like:
<select name="criteria" id="criteria">
<option value="1">Seach by Name</option>
<option value="2">Search by Father Name</option>
<option value="3">Search by Roll No.</option>
</select>
Then in PHP, just normally compare them on if else blocks or switch.
switch($criteria) {
case '1':
// do something
break;
case '2':
// do something
break;
case '3':
// do something
break;
}
Sidenote: I strongly suggest switch to the improved version API which is mysqli or use PDO instead, and use prepared statements.
Rough example (untested):
if(isset($_POST['criteria'], $_POST['value'])) {
$columns = array(1 => 'Name', 2, 'Father_Name', 3, 'Rol_No.');
$db = new mysqli('localhost', 'username', 'password', 'database');
$criteria = $_POST['criteria'];
if(!isset($columns[$criteria])) {
// column not found
exit;
}
$column_selected = $columns[$criteria];
$value = '%' . $_POST['value'] . '%';
$select = $db->prepare("SELECT * FROM students WHERE $column_selected LIKE ? ");
$select->bind_param('s', $value);
$select->execute();
if($select->num_rows > 0) {
// found
} else {
// none found
}
}

Answer 2

First of all brother $_POST['criteria'] get empty values And whenever you write a search query, always use LIKE clause.
Here is the Solution Rizwan sahib:
<select name="criteria" id="criteria">
<option name="name">Seach by Name</option>
<option name="father">Search by Father Name</option>
<option name"roll">Search by Roll No.</option>
</select>
<?php
$result = '';
if ($criteria == "name")
{
$result = mysql_query( "SELECT * FROM students WHERE Name LIKE '%$value'%" ) or die("SELECT Error: ".mysql_error());
$num_rows = mysql_num_rows($result);
}
elseif ($criteria == "father")
{
$result = mysql_query( "SELECT * FROM students WHERE Father_Name LIKE '%$value%'" ) or die("SELECT Error: ".mysql_error());
$num_rows = mysql_num_rows($result);
}
elseif ($criteria == "roll"){
$result = mysql_query( "SELECT * FROM students WHERE Roll_No. LIKE '%$value%'" ) or die("SELECT Error: ".mysql_error());
$num_rows = mysql_num_rows($result);
}
$row = mysql_fetch_array($result);
?>
The "%" sign is used to define wildcards (missing letters) both before and after the pattern.
Hope you find your solution