Hi guys,

its really simple but i really cant figure out what to do.

 

I have a page with one form and it has two submit buttons.

 

If the user enters in the location , the database queries according to the location name and if the user enters the cam no, it queries the cam no

 

Now I think i am getting the error because i have 2 submit buttons.

When I enter a junk value in the Cam no text box, it still gave me all the results.

 

i am attaching the relevant code and the sql code.

 

Any help will be highly appreciated.

 

Its so frustrating coz its supposed to be a simple DB query but i guess the two submit buttons are making it more complicated.

 

The GUI page is search.php

 

The result page is db.php

 

 

Please please please help!!!!!!

 

 

 

/* Database File */

 

-- phpMyAdmin SQL Dump

-- version 3.3.7deb1

-- http://www.phpmyadmin.net

--

-- Host: localhost

-- Generation Time: Sep 29, 2010 at 09:53 PM

-- Server version: 5.1.49

-- PHP Version: 5.3.3-1ubuntu9

 

SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";

 

 

/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;

/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;

/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;

/*!40101 SET NAMES utf8 */;

 

--

-- Database: `homes_in_havering`

--

 

-- --------------------------------------------------------

 

--

-- Table structure for table `cam_audit`

--

 

CREATE TABLE IF NOT EXISTS `cam_audit` (

`g_cam_no` int(11) NOT NULL,

`Estate` varchar(30) NOT NULL

) ENGINE=MyISAM DEFAULT CHARSET=latin1;

 

--

-- Dumping data for table `cam_audit`

--

 

INSERT INTO `cam_audit` (`g_cam_no`, `Estate`) VALUES

(0, 'Hatfield'),

(0, 'Hackney');

 

 

------------------------------------------------------------

search.php

db.php

Found the solution.

 

Hope this helps someone.

 

If i query

 

SELECT * FROM TABLENAME WHERE cam_no='ffffffff' ;

 

it will give all the results that have cam no = 0 ONLY!!!

 

So all the camera numbers that will have value 0 will come up in the result no matter what i type in the WHERE clause. Funny.

 

i donno why. is it a flaw or a security issue.

 

Would like to have some comment on this.

 

Hittesh

Thats expected behavior. You really need to filter your post variables and only accept integers though. Your code is putting your website at risk of SQL injection attacks. http://www.php.net/manual/en/function.filter-input.php