Link to home
Start Free TrialLog in
Avatar of satmanuk
satmanukFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Problem with search results when clicking page 2

Hi all,

I have a php search page where i have a form with 2 fields in which the user can search keywords and get results from a mysql database. I have a feature on the results page that limits the results by 10 and i have page numbers for each set of 10 records.
I have 2 pages. Fast_Keyword_Search.php and Keyword_Results.php
The search works great and i am really happy with it. But....Today i found that if i click a page number in my search results i get this error:
Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/user/public_html/estateagents/Keyword_Results.php on line 161

Warning: mysql_free_result(): supplied argument is not a valid MySQL result resource in /home/user/public_html/estateagents/Keyword_Results.php on line 167

I hope you can help me finish this off as i have a deadline looming.....

My code for both pages is attached using the Attach code snippet

Thanks in advance!
Fast_Keyword_Search.php code:
				  
					  <form action="Keyword_Results.php" method="post" name="form1" id="form1">
                          <table width="100%" border="0" cellspacing="0" cellpadding="0">
                            <tr>
                              <td class="copy">Search By Street                                </td>
                              <td class="copy"><input name="keyword_street" type="text" id="keyword_street" size="40">
                                or </td>
                            </tr>
                            <tr>
                              <td colspan="2">
                                <div align="center" class="search">
                                  <p>
                                    &nbsp;<?php if(isset($_REQUEST["street"])) echo $_REQUEST["street"]; ?>
                                  </p>
                            </div>						   </td></tr>
                            <tr>
                              <td class="copy">Search By Town                                </td>
                              <td class="copy"><input name="keyword_village" type="text" id="keyword_village" size="40"></td>
                            </tr>
                            <tr>
                              <td colspan="2" class="copy">
							  <div align="center">
							  <p>
							  &nbsp;<?php if(isset($_REQUEST["village"])) echo $_REQUEST["village"]; ?>
							  </p>
							  </div>							  </td>
                            </tr>
                            <tr>
                              <td colspan="2" class="copy"><div align="center">
                                <input type="submit" name="Submit" value="Submit">
                              </div></td>
                            </tr>
                          </table>
                        </form></td>
                      <td>&nbsp;</td>
                    </tr>
                    
                    
                    <tr> 
                      <td>&nbsp;</td>
                      <td class="copy">&nbsp;</td>
                      <td>&nbsp;</td>
                    </tr>
                  </table>
                </td>
                <td>&nbsp;</td>
              </tr>
              <tr>
                <td>
				
 
Keyword_Results.php:
 
<?php require_once('Connections/EE_con.php'); ?>
<?php
 
$maxRows_Recordset1 = 10;
$pageNum_Recordset1 = 0;
if (isset($_GET['pageNum_Recordset1'])) {
  $pageNum_Recordset1 = $_GET['pageNum_Recordset1'];
}
$startRow_Recordset1 = $pageNum_Recordset1 * $maxRows_Recordset1;
 
 
 
$keyword_street = "";
$keyword_village = "";
$case = 0;
if(!isset($_GET['pageNum_Recordset1'])) {
      
      if(!isset($_REQUEST["keyword_street"]) || $_REQUEST["keyword_street"]=='')
      {
              $message1 = "Please enter one of the fields";
      }
      
      if(!isset($_REQUEST["keyword_village"]) || $_REQUEST["keyword_village"]=='')
      {
              $message2 = "Please enter one of the fields";
      }
             
      if($message1!="" && $message2!="")
      {
              header("Location: Fast_Keyword_Search.php?street=$message1");
              // Keyword2.php is the name of the page where my search form is.
             exit();
      }
 
 
 
mysql_select_db($database_EE_con, $EE_con);
 
$keywordstreettrim = $_REQUEST['keyword_street'];
$keywordvillagetrim = $_REQUEST['keyword_village'];
$keywordstreet = trim($keywordstreettrim);
$keywordvillage = trim($keywordvillagetrim);
$K_street = $_POST['keyword_street'];
$K_village = $_POST['keyword_village'];
 
$queryString_Recordset1 = "&keyword_street=".$_REQUEST['keyword_street']."&keyword_village=".$_REQUEST['keyword_village'];
 
if ($keywordstreet) {
$test = "one";
}
if ($keywordvillage) {
$test2 = "two";
}
 
if ($test = "one" && $test2 = "two") {
$where_clause = "WHERE property_address1 LIKE '%$keywordstreet%' AND property_towncity LIKE '%$keywordvillage%'";
   }
 
$query_Recordset1 = "SELECT * FROM properties $where_clause ORDER BY price ASC";
$query_limit_Recordset1 = sprintf("%s LIMIT %d, %d", $query_Recordset1, $startRow_Recordset1, $maxRows_Recordset1);
 
$Recordset1 = mysql_query($query_limit_Recordset1, $EE_con) or die(mysql_error());
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);
 
 
if (isset($_GET['totalRows_Recordset1'])) {
  $totalRows_Recordset1 = $_GET['totalRows_Recordset1'];
} else {
  $all_Recordset1 = mysql_query($query_Recordset1);
  $totalRows_Recordset1 = mysql_num_rows($all_Recordset1);
}
$totalPages_Recordset1 = ceil($totalRows_Recordset1/$maxRows_Recordset1)-1;
 
 
if ($totalRows_Recordset1 == 0){
 
$message1 = "There are no results matching your search";
header("Location: Fast_Keyword_Search.php?street=$message1");
              // Keyword2.php is the name of the page where my search form is.
             exit();
 
}
 
}
?>
 
 
			
                    
					
					
					
					<?php echo $totalRows_Recordset1 ?> 
					<p>Records Found
					  
					  
					  
					  
					  
					  
					  Page           
					  <?php for ($i = 0; $i <= $totalPages_Recordset1; $i++) {
  $href = sprintf('%s?pageNum_Recordset1=%d%s', $currentPage, $i, $queryString_Recordset1);
  $label = $i + 1;
  echo '<a href="'.$href.'">'.$label.'</a>';
}
?>
				
 
<?
do {
?>
    
									  
					  
					 
		  
		  
 
 
                     
					</p>
					<table width="500" border="1">
                      <tr>
                        <td rowspan="3"><a href="Property_1.php?recordID=<?php echo $row_Recordset1['propertyid']; ?>"><img src="<?php echo $row_Recordset1['pic1']; ?>" width="151" height="114" border="0"></a></td>
                        <td><?php 
											  /*
											  echo $row_Recordset1['property_towncity']; 
											  $lastname = ucfirst($lastname);
											  */
											  $town = $row_Recordset1['property_towncity']; 
											  $town = ucwords($town);
											  echo $town;
											  ?></td>
                      </tr>
                      <tr>
                        <td><?php 
	  $price = $row_Recordset1['price']; 
	  $price_formatted = number_format($price);
	  echo "£" . $price_formatted;
	  
	  ?></td>
                      </tr>
                      <tr>
                        <td><?php echo $row_Recordset1['desc_1']; ?></td>
                      </tr>
                      <tr>
                        <td>&nbsp;</td>
                        <td><a href="Property_1.php?recordID=<?php echo $row_Recordset1['propertyid']; ?>" class="copylink"> 
                                 View Full Details</a></td>
                      </tr>
                      <tr>
 
                        <td>&nbsp;</td>
                        <td>&nbsp;</td>
					
                      </tr>
                    </table>
					  <?php
} while ($row_Recordset1 = mysql_fetch_assoc($Recordset1)); 
 ?>	
 
	
					
<?php 
mysql_free_result($Recordset1);
?>

Open in new window

Avatar of wildzero
wildzero

First thing I notice is you are leaving your code open to XSS and SQL injection attacks. Maybe you have left out the part that cleans the $_REQUEST array, but if you are not sanatizing the user input then you should fix it asap.

Looking at the code now.
ASKER CERTIFIED SOLUTION
Avatar of wildzero
wildzero

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of satmanuk

ASKER

This is not a live site yet, i have stripped most of the code so i dont give too much away on here.

i must admit i am yet to cover the security aspect of the site. Any pointers would be good!

Thanks
Top advice!