format php query result [closed] - php

Question

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 8 years ago.
Improve this question
I have this code:
$list_summoners = $con->query("SELECT * FROM verified_users WHERE Username='" . $search_user . "'");
and I was wondering how I could format it, like:
$list_summoners = mysqli_query($con, "SELECT * FROM verified_users WHERE Username='" . $search_user . "'");
echo '<table align="center" style="text-align:center;"><tr><th>User</th><th>Summoner ID</th><th>Summoner Region</th><th>View Summoner</th></tr>';
while($row = mysqli_fetch_array($list_summoners)) {
echo '<tr><td>' . $row['username'] . '</td><td>' . $row['summoner_id'] . '</td><td>' . $row['summoner_region'] . '</td><td><span class="button color_dark">View</span></td></tr>';
}
echo '</table>';
I am asking this, because I know mysqli_query is open to abuse.
Thanks in advance.

Answer 1

mysqli_query($con, 'SELECT...') called in procedural mode, vs $con->query('SELECT...') called in object-oriented mode perform exactly the same function. In both modes, $con is the same object - a mysqli connection object, but the MySQLi API offers two methods of interacting with it.
So, the use of mysqli_query() and $con->query() are both equally insecure when used the way you are using them, concatenating in a variable $search_user. The secure method would be to avoid mysqli_query() entirely and instead use a prepared statement:
$stmt = $con->prepare('SELECT * FROM verified_users WHERE Username = ?');
if ($stmt) {
$stmt->bind_param('s', $search_user);
$stmt->execute();
// Then bind & fetch()...
}
else echo $con->error;
See How can I prevent SQL injection in PHP for more details & examples on executing and fetching from the prepared statement.
Using $con->query() as you are, to fetch rows with a while loop you may call $list_summoners->fetch_array() as it is an object of class mysqli_result
if ($list_summoners) {
while ($row = $list_summoners->fetch_array()) {
echo '<table align="center" style="text-align:center;"><tr><th>User</th><th>Summoner ID</th><th>Summoner Region</th><th>View Summoner</th></tr>';
echo '<tr><td>' . htmlspecialchars($row['username']) . '</td><td>' . htmlspecialchars($row['summoner_id']) . '</td><td>' . htmlspecialchars($row['summoner_region']) . '</td><td><span class="button color_dark">View</span></td></tr>';
echo '</table>';
}
}
Note the addition of htmlspecialchars() to those values, when sent to output as HTML. Even if these were not originated from user input, it is an important habit to be in as it will prevent cross-site scripting when outputting values originating from user input, or values which contain characters requiring entity encoding in HTML.