I'm writing some code that returns the results of an event. In this table I have some fields that are populated with data from MySQL, including a download link for a certificate.
But now, I need to add a search field. This is what I have done so far:
<?php
include "open.php";
$sql = "SELECT * FROM results";
if (isset($_POST['search'])){
$search_term = mysql_real_escape_string($_POST['search_box']);
$sql .= "WHERE Name = '{$search_term}' ";
$sql .= "OR Place = '{$search_term}'";
}
$query = mysql_query($sql) or die(mysql_error());
?>
<form name="search_form" method="POST" action="teste3.php">
Search: <input type="text" name="search_box" value="" />
<input type="submit" name="search" value="Search">
</form>
<table width="70%" cellpadding="5" cellspace="5">
<tr>
<td>
<strong>Place</strong>
</td>
<td>
<strong>Name</strong>
</td>
<td>
<strong>Category</strong>
</td>
<td>
<strong>Certificate</strong>
</td>
</tr>
<?php while ($row = mysql_fetch_array($query)){ ?>
<tr>
<td><?php echo $row['Place']; ?></td>
<td><?php echo $row['Name']; ?></td>
<td><?php echo $row['Category']; ?></td>
<td>
<a href="http://(...)/<?php echo $row['Place']; ?>.pdf"
style="color: #000000" target="blank">Download Certificate</a>
</td>
</tr>
<?php } ?>
</table>
But for some reason when I do a test search, the browser echoes:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '= 'ulisses' OR Place = 'ulisses'' at line 1.
resultadosandWHEREwhen you concatenate them.