MySQL: SELECT * FROM with a Variable from an HTML form

Question

Hello,
I would like to insert the variable "find" from the HTML form below in the MySQL "SELECT * FROM" query beneath it.  In other words, where the word "santafe" appears below, I would like to insert the variable "$find."  But I can't quite get it to work.  How do I do it?
Thanks in advance,
John
<form action="tsearch11.php" method="post">
<label>Enter Topic:
<input type="text" name="find" size="55"/>
<input type="hidden" name="searching" value="yes" />
<input type="submit" name="search" value="Search" />
</label>
</form>
Then, on tsearch11.php:
<?
mysql_connect("mysqlv3", "username", "password") or die(mysql_error());
mysql_select_db("sand2") or die(mysql_error());
$find = strip_tags($find);
$find = trim ($find);
$t = "SELECT * FROM santafe"; 
$y = mysql_query($t);
?>

Answer 1

Putting a form variable in a SQL query to look for table or column names requires an extra level of security. You need to create an array of the valid names, and check that the form variable is in that array.
$find = get_magic_quotes_gpc() ? stripslashes($_POST['find']) : $_POST['find'];
$find = mysql_real_escape_string(trim($find));
// create an array of valid table names
$tables = array('santafe', 'sanfernando', 'guadalupe');
// check that the variable is in the permitted array
if (in_array($find, $tables)) {
  $t = "SELECT * FROM $find"; 
  $y = mysql_query($t);
} else {
  $error = 'Sorry, you selected an invalid table.';
In the page itself, check whether $y exists before using it. Otherwise display the error:
if (isset($y)) {
  // display the results
} elseif (isset($error)) {
  echo $error;