search query help

[stesouthby]

hey guys am doing a simple mysql query but keep gettingan error with this part of the php file

while ($row = mysql_fetch_array($sql)){

and this is the error i get i cant work out why wonder if you knew any better?

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in ///l/search.php on line 9


<?php
mysql_connect ("localhost", "","") or die (mysql_error());
mysql_select_db ("");

$company_name = $_POST['company_name'];

$sql = mysql_query("select * from customertable where company_name like '%$company_name%'");

while ($row = mysql_fetch_array($sql)){
echo 'ID: '.$row['customer_ID'];
echo '<br/> First Name: '.$row['company_name'];
echo '<br/> Last Name: '.$row['customer_name'];
echo '<br/> Phone: '.$row['email'];
echo '<br/><br/>';
}
?>

 

[misson]

Here we go again...

• That error has been covered quite a few times in these forums. It means the query failed. You'll need to add error handling to discover the MySQL error.
• Your script is open to SQL injection. The best way to resolve this is to switch to the PDO driver and use prepared statements. If you want a tutorial, read "Writing MySQL Scripts with PHP and PDO".
• Don't use or die.
• Don't output mysql_error() to every user. It discloses too much information.
• Don't use SELECT *
• Don't use <br/> that way; it's not semantic. In this case, use a definition list.

 

[bdistler]

See me post in this thread in this forum:

"PHP/SQL: Increment Integer Value in Database via Form"