我的查询没有找到结果

Question

I'm trying this query but I'm not able to get my results. I cant find the error! Here is my table structure:

id  norm(mediumtext) bohrung(int)       breite(int)     
 2  DIN 5462         26             6           
 3  DIN 5462         28             7           
 4  DIN 5462        32              6           
 5  DIN 5462        36              7           
 6  DIN 5462        42              8           
 7  DIN 5462        46              9       

This is my SQL query

<?php       
if (isset($_POST['bohrung'])) {
    $bohrung = $_POST['bohrung'];
    $result = mysqli_query ($con, "SELECT * FROM keilnaben WHERE norm  = {bohrung}");
    if($result && mysqli_num_rows($result) > 0) {
        echo '<table class="table" border="2">
                  <tr>
                     <th>norm</th>
                     <th>norm</th>
                     <th>norm</th>
                  </tr>';
        while($row = mysqli_fetch_array($result)) {
            echo "<tr>
                      <td>" . $row['norm'] . "</td>
                      <td>" . $row['bohrung'] . "</td>
                      <td>" . $row['breite'] . "</td>
                 </tr>";
        }
        echo "</table>";
    }

}

The problem is that when I enter for example DIN5462 in the text box, the query does not return anything, but if I try the same for bohrung of breite, it does return results. I don't know why.

Answer 1

The problem is this line:

SELECT * FROM keilnaben WHERE norm  = {bohrung}
                                       ^^^
// its a string literal, not a variable

Change it to this and at least escape your input:

$bohrung = $con->real_escape_string($_POST['bohrung']);
$result = mysqli_query($con,"SELECT * FROM keilnaben WHERE norm  = '$bohrung' ");  

Or prepared statements:

if (isset($_POST['bohrung'])) {
    $input = $_POST['bohrung'];
    $select = $con->prepare('SELECT * FROM keilnaben WHERE norm = ?');
    $select->bind_param('s', $input);
    $select->execute();
    if($select->num_rows > 0) {
        echo '<table class="table" border="2">
                <tr>
                   <th>norm</th>
                   <th>norm</th>
                   <th>norm</th>
                </tr>';
        $select->bind_result($norm, $bohrung, $breite);
        while ($select->fetch()) {
            echo "<tr>
                      <td>" . $norm . "</td>
                      <td>" . $bohrung . "</td>
                      <td>" . $breite . "</td>
                 </tr>";
        }
        echo "</table>";
    }
}