Search form with PDO | 易学教程

问题

The below code now works but how can I make it so if no results are found it echos a message instead of blank.

I think I've managed to create a search query for my database. Its only a very basic search but it doesn't seem to work for some reason. Any advice would be appreciated im still new to pdo (very new! be kind!).

Also no user submitted data is inserted into the database so I think i can rule out xss assuming its SQL inject free? Which from what I understand PDO is? plus im using a stand alone DB user with no write access.

Have replace data with xxx for security

file is called search.php

*updated to reflect changes suggested *2nd update to reflect help provided *3rd update

   <html>
<head>
</head>
<body>
<form name="frmSearch" method="post" action="search.php">
  <table width="599" border="1">
    <tr>
      <th>Keyword
      <input name="var1" type="text" id="var1">
      <input type="submit" value="Search"></th>
    </tr>
  </table>
</form>
<?php
$nameofdb = 'xxxxxx';
$dbusername = 'xxxxxxxxxxxxxx';
$dbpassword = 'xxxxxxxxxxxxx';



// Connect to MySQL via PDO
try {
$dbh = new PDO("mysql:dbname=$nameofdb;host=localhost", $dbusername, $dbpassword);
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
echo 'Connection failed: ' . $e->getMessage();
}

$var1 = str_replace(array('%','_'),'',$_POST['var1']);
if (!$var1)
{
    exit('Invalid form value: '.$var1);
}


$query = "SELECT * FROM xxxxx WHERE xxxxxx LIKE :search OR xxxxx LIKE :search";
$stmt = $dbh->prepare($query);
$stmt->bindValue(':search', '%' . $var1 . '%', PDO::PARAM_INT);
$stmt->execute();

/* Fetch all of the remaining rows in the result set */
print("Fetch all of the remaining rows in the result set:\n");


 $result = $stmt->fetchAll();

foreach( $result as $row ) {
    echo $row["id"];
    echo $row["title"];
}




?>

</body>
</html>

回答1:

The problem is in the form. the method is GET but in your php you expect $_POST

So this line:

<form name="frmSearch" method="get" action="search.php">

should be:

<form name="frmSearch" method="post" action="search.php">

UPDATE

Change this:

// Connect to MySQL via PDO
try {
$dbh = new PDO("mysql:dbname=$nameofdb;host=localhost", $dbusername, $dbpassword);
} catch (PDOException $e) {
echo 'Connection failed: ' . $e->getMessage();
}

$var1 = $_POST['var1'];


$query = "SELECT * FROM xxxxx WHERE xxxx LIKE ? OR xxxxx LIKE ?";
$params = array("%$var1%");
$stmt = $handle->prepare($query);
$stmt->execute($params);

to this:

// Connect to MySQL via PDO
try {
$dbh = new PDO("mysql:dbname=$nameofdb;host=localhost", $dbusername, $dbpassword);
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
echo 'Connection failed: ' . $e->getMessage();
}

$var1 = $_POST['var1'];


$query = "SELECT * FROM xxxxx WHERE xxxx LIKE :search OR xxxxx LIKE :search";
$stmt = $dbh->prepare($query);
$stmt->bindValue(':search', '%' . $var1 . '%', PDO::PARAM_INT);
$stmt->execute();

UPDATE 2

I just see you use $handle for the connection but you define $dbh. I guess if you change $handle to $dbh it will work

update 3

change this line:

$result = $sth->fetchAll();

to this:

$result = $stmt->fetchAll();

UPDATE 4

To check if there are no line and give a message you can do it like this:

if ($stmt->rowCount() > 0) { 
$result = $stmt->fetchAll();

foreach( $result as $row ) {
echo $row["id"];
echo $row["title"];
}
} else {
echo 'There is nothing to show';
}

回答2:

i wrote this method and use in every project i working on it . try it :)

public function searchForQueryString($queryString)
{
    $query = "SELECT * FROM `xxxx` WHERE (`xxxxxxx` like :queryString or `xxxxx` like :queryString) ";

    $sth = $this->prepare($query);
    $queryString = '%' . $queryString . '%';
    $sth->bindParam('queryString', $queryString, PDO::PARAM_STR);

    $sth->execute();

    $result = $sth->fetchAll(PDO::FETCH_OBJ);

    if(empty($result) or $result == false)
       return array();
    else
        return $result;
}

来源：https://stackoverflow.com/questions/17674369/search-form-with-pdo

标签

php

pdo