Menu
Community /Pin to ProfileBookmark
@NogDogNov 24.2021 — #@danielabeldev#1639800 I edited your post to use this forum's
Should be more like:
It does not look to me like the query would be valid if any keywords are submitted, since the WHERE clause would end with an "OR". (Also,[mysqli_real_escape_string()](https://www.php.net/manual/en/mysqli.real-escape-string.php) .)
But in any case, searching for matches on each word means any DB row that includes any one of those words in that field is going to match -- not sure if that's what you really want? Also, doing
Well, that's a lot to chew on, without even tackling everything I see. :(
How to **properly** display images in a PHP form from a mysql db.
I am struggling on getting images from a mysql database to display properly. My overall goal is to have a product page that you search by keyword and then spits out the results. I want the images to be displayed with each corresponding row.
My **issue is that
I am also working to fix the security issue by using prepared statements as well.
Thank you for any help whatsoever, it is greatly appreciated!
i will paste my code below.
[code]
<?php
include(“include.php”);
define(“SITE_ADDR”, “http://localhost/fragrance.php”);
?>
<!DOCTYPE html>
<head>
<link href=”test.css?v=<?php echo time(); ?>” type=”text/css” rel=”stylesheet”>
<meta name=”viewport” content=”width=device-width, initial-scale=1″>
<meta http-equiv=”X-UA-Compatible” content=”ie=edge”>
<meta charset=”UTF-8″>
</head>
<header>
<nav>
<ul>
<li><a href=”parallax.php”>Home</a></li>
<li><a href=”brands.php”>Brands</a></li>
<li><a href=”comment.php”>Leave me a comment</a></li>
<li><a href=”index.html”>Other</a></li>
</ul>
</nav>
</header>
<body>
<main>
<center>
<h1>Find My Fragrance</h1>
<form action= ”
method=’GET’ enctype=”multipart/form-data”>
<table>
<tr>
<td><input type=”text” name=”k” size=”75%” placeholder=”search a scent”></td>
<td><input type=”submit” name=”” value=’search’ class=”button”></td>
</table>
</form>
<?php
if (isset($_GET[‘k’]) && $_GET[‘k’] != ”) {
//save keywords from url
$k = trim($_GET[‘k’]);
//base query for search
$query_string = “SELECT * FROM fragrance.scent WHERE “;
$display_words = “”;
//seperate each keyword in variable
$keywords = explode(‘ ‘, $k);
foreach($keywords as $word){
$query_string .= “keywords LIKE ‘%”.$word.”%’ OR “;
$display_words .= $word.” “;
}
$query_string = substr($query_string, 0, strlen($query_string) -3);
$conn = mysqli_connect(DB_SERVER, DB_USER, DB_PASS, DB_NAME);
$query = mysqli_query($conn, $query_string);
$result_count = mysqli_num_rows($query);
$image = $row[‘image’];
$src = $row[‘image’];
$id = $row[‘scent_id’];
//check to see if any results returned
if ($result_count > 0)
{
//display result count to user
echo ‘<div class=”right”><u>’.$result_count.'</u></b>results found</div>’;
echo ‘Your search for <i>’.$display_words.'</i><hr />’;
echo ‘<table class=”search”>’;
//display all results
while ($row = mysqli_fetch_assoc($query)){
echo ‘<td>’;
echo ‘<div class=”contain”>’;
echo ‘<div class=”image”>’;
echo ‘<td><img src=”‘.$row[‘image’].'</td>;
echo ‘<td><b>’.$row[‘brand_name’].'</b></td>’;
echo ‘<td><i>’.$row[‘product_name’].'</i></td>’;
echo ‘<td>’.$row[“Eau”].'</td>’;
echo ‘<td>’.$row[“top_notes”].'</td>
<td>’.$row[‘mid_notes’].'</td>
<td>’.$row[‘base_notes’].'</td>
<td>’.$row[‘sex’].'</td></tr>’;
}
}
else
echo ‘No results found. Please use a different keyword.’;
}
else
echo ”;
?>
</body>
</main>
</html>
Sign in
to post a comment2 Comments(s) ↴
0
@NogDogNov 24.2021 — #...</>0
@NogDogNov 24.2021 — #There's an awful lot to look at there. I'd start by trying to functionalize things instead of just one long sequence of stream-of-consciousness PHP code. This line is missing some quotes and should be causing a fatal PHP parse error, I would think:<i>
</i>echo '<td><img src="'.$row['image'].'</td>;
Should be more like:
<i>
</i>echo '<td><img src="'.$row['image'].'"</td>';
It does not look to me like the query would be valid if any keywords are submitted, since the WHERE clause would end with an "OR". (Also,
$wordBut in any case, searching for matches on each word means any DB row that includes any one of those words in that field is going to match -- not sure if that's what you really want? Also, doing
LIKE '%anything%'Well, that's a lot to chew on, without even tackling everything I see. :(