Issue when using $_POST['xyz'] in SELECT

Question

REPOST:
The situation: Searching a small database with PHP/MySQL with
DW8.0.2
1. I have a form where users can enter a name (or a portion
of a name) and select which col in the db the name relates to. It
POSTs the results to a seperate page to look up and display the
result. The 2 form fields are name and column.
2. I have created a simple test page whereby I place the POST
values for the fields into 2 vars ($name and $column)
3. I created a simple recordset:
SELECT *
FROM table3
WHERE $column LIKE '%$name%'
ORDER BY FamilyName ASC
which works perfectly. The recordset code is:
mysql_select_db($database_connConvictsMySQL,
$connConvictsMySQL);
$query_rsConvicts = "SELECT * FROM table3 WHERE $col LIKE
'%$name%' ORDER BY FamilyName ASC";
$rsConvicts = mysql_query($query_rsConvicts,
$connConvictsMySQL) or die(mysql_error());
$row_rsConvicts = mysql_fetch_assoc($rsConvicts);
$totalRows_rsConvicts = mysql_num_rows($rsConvicts);
4. So with that in mind I attempted to use the $_POST values
directly in the recordset using the Add Varianbles section and
removed the vars I mentioned in 2 above. I thought this would
provide a more secure, elegant solution as the code created adds in
all the extra security code. I finished up with a recordset SQL as:
SELECT *
FROM table3
WHERE column LIKE %name%
ORDER BY FamilyName ASC
and the record set code created is:
$name_rsConvicts = "-1";
if (isset($_POST['enteredName'])) {
$name_rsConvicts = (get_magic_quotes_gpc()) ?
$_POST['enteredName'] : addslashes($_POST['enteredName']);
$column_rsConvicts = "-1";
if (isset($_POST['selectedColumn'])) {
$column_rsConvicts = (get_magic_quotes_gpc()) ?
$_POST['selectedColumn'] : addslashes($_POST['selectedColumn']);
mysql_select_db($database_connConvictsMySQL,
$connConvictsMySQL);
$query_rsConvicts = sprintf("SELECT * FROM table3 WHERE %s
LIKE CONCAT('%%', %s, '%%') ORDER BY FamilyName ASC",
GetSQLValueString($column_rsConvicts,
"text"),GetSQLValueString($name_rsConvicts, "text"));
$rsConvicts = mysql_query($query_rsConvicts,
$connConvictsMySQL) or die(mysql_error());
$row_rsConvicts = mysql_fetch_assoc($rsConvicts);
$totalRows_rsConvicts = mysql_num_rows($rsConvicts);
In this case I dont get any results. I would really
appreciate any suggestions . Thanks.

Answer 1

Hi David
I must admit I felt like a goose when I read your post as I
did not delete the Recordset and re-create it.
So, I recreated the recordset and again it still fails. Here
is what I had when I re-created the code: (I have changed the
variable from what was previously "column" to "field"
SQL:
SELECT *
FROM table3
WHERE field LIKE %name%
Code:
$name_rsConvicts = "-1";
if (isset($_POST['enteredName'])) {
$name_rsConvicts = $_POST['enteredName'];
$field_rsConvicts = "-1";
if (isset($_POST['selectedColumn'])) {
$field_rsConvicts = $_POST['selectedColumn'];
mysql_select_db($database_connConvictsMySQL,
$connConvictsMySQL);
$query_rsConvicts = sprintf("SELECT * FROM table3 WHERE %s
LIKE %s", GetSQLValueString($field_rsConvicts,
"text"),GetSQLValueString("%" . $name_rsConvicts . "%", "text"));
$rsConvicts = mysql_query($query_rsConvicts,
$connConvictsMySQL) or die(mysql_error());
$row_rsConvicts = mysql_fetch_assoc($rsConvicts);
$totalRows_rsConvicts = mysql_num_rows($rsConvicts);
So, next I edited the code manually to be:
$name_rsConvicts = "-1";
if (isset($_POST['enteredName'])) {
$name_rsConvicts = $_POST['enteredName'];
$field_rsConvicts = "-1";
if (isset($_POST['selectedColumn'])) {
$field_rsConvicts = $_POST['selectedColumn'];
mysql_select_db($database_connConvictsMySQL,
$connConvictsMySQL);
$query_rsConvicts = sprintf("SELECT * FROM table3 WHERE
$field_rsConvicts LIKE %s", GetSQLValueString("%" .
$name_rsConvicts . "%", "text"));
$rsConvicts = mysql_query($query_rsConvicts,
$connConvictsMySQL) or die(mysql_error());
$row_rsConvicts = mysql_fetch_assoc($rsConvicts);
$totalRows_rsConvicts = mysql_num_rows($rsConvicts);
Note that I have removed the first %s from the SELECT and
replaced it with the actual variable $field_rsConvicts and have
also dropped the reference to it from the rest of the sprintf().
This works fine - on my testing server which has magic_quotes_gpc
set to ON.
The problem appears to be related to the code above the RS
code that begins with:
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType,
$theDefinedValue = "", $theNotDefinedValue = "")
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue)
: $theValue;
or the call to it from the sprintf() surrounding the SELECT
statement.
Regards,