php search engine for a database with foreignkeys - php

Question

hi all Im trying to create a php search page that will bring up a list of books from a mysql database, then when the book name is clicked bring up a a list of books that are in a relationship table with them. I'm slightly struggling with the code and was hoping someone would be able to lend a hand
-This is my search.php file
<?php
$i=0;
$column_name = 'title'; // column to search by
$k =$_GET['k'];
$terms = explode(" ",$k);
//connect before calling mysql_real_escape_string
mysql_connect("localhost","","");
mysql_select_db("test");
$query ="SELECT id,title,author
FROM books WHERE";
foreach ($terms as $each){
$i++;
$each = '%' . $each . '%'; // add wildcard
$each = mysql_real_escape_string($each); // prevent sql injection
if($i==1)
$query .= " $column_name LIKE '$each' ";
else
$query .= " OR $column_name LIKE '$each' ";
}
echo 'QUERY: ' . $query;
$query = mysql_query($query) OR DIE(mysql_error());
//Code below is for using the relationships table assuming you have a column name id that
//references to the relationships table. Also, you should add a index on the column id.
$results = "";
while($row = mysql_fetch_array($query)) {
$results .= '<li>
'.$row['title'].' author: '.$row['author'].'
</li>';
}
$results = '<ul>' . $results . '</ul>';
echo $results;

Answer 1

Remove a "; from this line:
FROM books WHERE "; ";
You must declare $i
$i = 0;
To prevent sql injection you can use:
foreach ($terms as $each){
$i++;
$each = '%' . $each . '%'; // add wildcard
$each = mysql_real_escape_string($each); // prevent sql injection
if($i==1)
$query .= " $keywords LIKE '$each' ";
else
$query .= " OR $keywords LIKE '$each' ";
}
Also, ake sure the user cannot set the variable to a table that does not exist
Full Code
<?php
$i=0;
$column_name = 'title'; // column to search by
$k =$_GET['k'];
$terms = explode(" ",$k);
//connect before calling mysql_real_escape_string
mysql_connect("localhost","","");
mysql_select_db("test");
$query ="SELECT id,title,author
FROM books WHERE";
foreach ($terms as $each){
$i++;
$each = '%' . $each . '%'; // add wildcard
$each = mysql_real_escape_string($each); // prevent sql injection
if($i==1)
$query .= " $column_name LIKE '$each' ";
else
$query .= " OR $column_name LIKE '$each' ";
}
echo 'QUERY: ' . $query;
$query = mysql_query($query) OR DIE(mysql_error());
//Code below is for using the relationships table assuming you have a column name id that
//references to the relationships table. Also, you should add a index on the column id.
$results = "";
while($row = mysql_fetch_array($query)) {
$results .= '<li>
'.$row['title'].' author: '.$row['author'].'
</li>';
}
$results = '<ul>' . $ results . '</ul>';
echo $results;