如何在PHP中无法从DB中获取时显示错误

Question

below is a code to display table rows fetched from DB when the Sql Query returnes result.

<?php
if(isset(['submit']))
{
$key=$_POST['txt_srchKey'];
}



if($key!="")
{
$all_entries=mysql_query("SELECT * FROM tbl_book WHERE bookAuthor='$key'|| bookName='$key'||bookCode='$key' "); 
?>  
<table border=1 align="left">
<tr>
<td><b>Book Code</b></td><td><b>Book Name</b></td><td><b>Edition</b></td><td><b>Author</b></td>
</tr>
<?php
while($row=mysql_fetch_array($all_entries))
{ ?>

<tr>
<td><?php echo $row['bookCode'] ?></td>
<td><?php echo $row['bookName'] ?></td>

<td><?php echo $row['bookEdition'] ?></td>
<td><?php echo $row['bookAuthor'] ?></td>
</tr>
<?php
}   
?>              
</table>

I am getting the result in the table when the condition (bookAuthor='$key'|| bookName='$key'||bookCode='$key')is true.but if there is no result it only showing the table headins eg:Book Code, Book Name etc. But instead of this I need to display 'No result found'.How can I do this by editing my code?

Answer 1

Without immediately getting into the problems with your code, you can use mysql_num_rows.

<?php
if(isset(['submit']))
{
    $key=$_POST['txt_srchKey'];
}
if($key!="")
{
    $all_entries=mysql_query("SELECT * FROM tbl_book WHERE bookAuthor='$key'|| bookName='$key'||bookCode='$key' "); 
    if(mysql_num_rows($all_entries) > 0)
    {
        ?>  
        <table border=1 align="left">
        <tr>
            <td><b>Book Code</b></td><td><b>Book Name</b></td><td><b>Edition</b></td><td><b>Author</b></td>
        </tr>
        <?php
        while($row=mysql_fetch_array($all_entries))
        {
        ?>
            <tr>
                <td><?php echo $row['bookCode'] ?></td>
                <td><?php echo $row['bookName'] ?></td>
                <td><?php echo $row['bookEdition'] ?></td>
                <td><?php echo $row['bookAuthor'] ?></td>
            </tr>
        <?php
        }   
        ?>              
        </table>
        <?php
    }
    else
    {
        ?><p>No result found</p><?php
    }
}

There are a few things about this code that I should draw attention to:

---

Issue 1

This line is invalid:

if(isset(['submit']))

I think you mean to use:

if(isset($_POST['submit']))

---

Issue 2

This SQL statement is wide-open to SQL injection:

mysql_query("SELECT * FROM tbl_book WHERE bookAuthor='$key'|| bookName='$key'||bookCode='$key' ")

You could improve security on this by using mysql_real_escape_string when you set $key like this:

$key=mysql_real_escape_string($_POST['txt_srchKey']);

However, this is not a perfect solution in all cases, when brings me to my final point.

---

Issue 3

mysql_query and all the other mysql_* are deprecated in the latest versions of PHP. See the warning on the mysql_query page and the MySQL: choosing an API for more information. You may want to consider using MySQLi or PDO as making secure database queries is much easier in these extensions.