TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
Advertisement
Associates
Associates
techtuts Darkmindz
CSS Tutorials Tutorialsphere.com - Free Online Tutorials
Boston PHP SurfnLearn
Reply
 
LinkBack Thread Tools Display Modes
Old 10-06-2007, 03:53 PM   #21 (permalink)
Moderateur
RegEx Guru PHP Guru Top Contributor Advanced Programmer 
 
Salathe's Avatar
 
Join Date: Apr 2007
Posts: 700
Thanks: 2
Salathe is on a distinguished road
Default

Why bother with using sprintf if you're going to be wrapping the username inside a string in the arguments? If you want to use the function properly (in my eye) then go for something more akin to:
PHP Code:
// Note: %% outputs a literal percent character with (s)printf
// See:  http://php.net/sprintf for details
$szSQL sprintf("SELECT user,id,rank FROM users WHERE user LIKE '%%%s%%' ORDER BY id"$szUsername); 
Keep the format string (the query) in one place, and the arguments in another. That's the whole idea of using (s)printf in instances like this.
__________________
Salathe is offline  
Reply With Quote
Old 10-06-2007, 04:40 PM   #22 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 349
Thanks: 24
Haris is on a distinguished road
Default

Cool, it works.

Thanks Karl
Haris is offline  
Reply With Quote
Old 10-06-2007, 04:42 PM   #23 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 349
Thanks: 24
Haris is on a distinguished road
Default

Good point Salathe. :)
Haris is offline  
Reply With Quote
Old 10-07-2007, 12:24 AM   #24 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 349
Thanks: 24
Haris is on a distinguished road
Default

How would you search query an integer?

PHP Code:
            elseif($_POST['areaCode'] != ''){
                
$szSQL sprintf("SELECT id FROM schools WHERE areaCode LIKE '%%%d%%' ORDER BY id"$_POST['areaCode']);
                
$iResult $database->execute($szSQL);
                while(
$iRow mysql_fetch_array($iResultMYSQL_ASSOC)){
                    
print_r($iRow);
                }
            } 
It prints the array but with an error.
Array ( [id] => 28 ) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1
Haris is offline  
Reply With Quote
Old 10-07-2007, 01:12 AM   #25 (permalink)
The Gregarious
Upcoming Programmer Inquisitive 
 
Join Date: Sep 2007
Posts: 652
Thanks: 82
Tanax is on a distinguished road
Default

PHP Code:
elseif($_POST['areaCode'] != ''){
                
$szSQL sprintf("SELECT `id` FROM `schools` WHERE `areaCode` LIKE '%%%d%%' ORDER BY `id`"$_POST['areaCode']);
                
$iResult $database->execute($szSQL);
                while(
$iRow mysql_fetch_array($iResultMYSQL_ASSOC)){
                    
print_r($iRow);
                }
            } 

Try that..
Tanax is offline  
Reply With Quote
Old 10-07-2007, 01:33 AM   #26 (permalink)
The Frequenter
Prolific Welcomer Upcoming Programmer 
 
Join Date: Sep 2007
Posts: 349
Thanks: 24
Haris is on a distinguished road
Default

It was another SQL statement causing error. Sorry

Edit: What are those percentage signs for?

How can I search for an integers through the prefix? For example I have 1, I want the query to search the following values:

15346
1546
16436
16347

And not:

5315
3515
53621
64251

Last edited by Haris : 10-07-2007 at 03:03 AM.
Haris is offline  
Reply With Quote
Old 10-07-2007, 01:54 PM   #27 (permalink)
La Vida es Sueño
Advanced Programmer Top Contributor 
 
Wildhoney's Avatar
 
Join Date: Sep 2007
Location: Oldham
Posts: 1,541
Thanks: 72
Wildhoney is on a distinguished road
Default

Take off the percentages from the beginning. So you effectively end up with something like: %d%. The percentage sign is nothing more than a wild-card.
__________________
The man who comes back through the Door in the Wall will never be quite the same as the man who went out.
Send a message via AIM to Wildhoney Send a message via MSN to Wildhoney Send a message via Yahoo to Wildhoney
Wildhoney is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 05:45 PM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0