php search problem

[Wardy]

Got another what I think is a simple coding question.
I have a search on one of my sites that includes a drop down menu ($searchpr) and also a search box ($searchprname) that both get filled in when a user searches.

The pageis called search.php and the search results get displayed back on search.php too.
Some records have "favpr" and "prusername" blank and these are gettign displayed on the search.php page before a search has been done.
What do I need to do to stop this?

PHP Code:


$searchpr = $_GET["searchpr"];
$searchprname = $_GET["searchprname"];

    $query  = "SELECT * FROM players WHERE favpr ='$searchpr' AND prusername LIKE '%$searchprname%' ORDER BY username";
    $result = mysql_query($query) or die("Error: " . mysql_error()); 

    if(mysql_num_rows($result) == 0){ 
        echo(""); 
    } 


I hope that makes sence?!

Cheers
Wardy

[haggul]

If it's a self calling page add a hidden field into your form called perhaps Mode and with a hard coded value of "Search"

Then wrap an if statement around the code that builds and runs the query that checks for $_GET["Mode"]=="Search" - i.e. so the page won't do anything until it has first been submitted.

At the moment it's running the query regardless I imagine, and the lack of anything in those variables means you get all records where those fields are blank - i.e. it's returning exactly what it's being asked to.

[Rich]

If you want the user to be able to search for the blank records then add a hidden field to the form and only do the seach if that field is set.

If you will never show those blank fields then do something like: -

PHP Code:

if (($searchpr!='') || ($searchprname!='')) { 
  //do search and show results,
} else {
  // don't do search
} 


[Wardy]

Haggul & Rich nice one
Exacly what I needed, it now works

Cheers
Wardy

[trevHCS]

Erm, on a slight side note, you do sanitise the users input before putting it into the database query, don't you? Eg: at the very least:

http://uk.php.net/manual/en/function...ape-string.php

Or as we preach at the Ministry of Geek - users are dumb creatures and will always set out to break your system by doing really stupid things.

Trev