-
Notifications
You must be signed in to change notification settings - Fork 18
/
searchproducts.php
121 lines (89 loc) · 2.21 KB
/
searchproducts.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
<!-- Enable debug using ?debug=true" -->
<?php
ob_start();
session_start();
include("db_config.php");
if (!$_SESSION["username"]){
header('Location:Login1.php?msg=1');
}
ini_set('display_errors', 1);
?>
<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Search Products - SQL Injection Training App</title>
<link href="./css/htmlstyles.css" rel="stylesheet">
</head>
<body>
<div class="container-narrow">
<div class="jumbotron">
<p class="lead" style="color:white">
Welcome <?php echo $_SESSION["username"]; ?>!! Search for products here</a>
</p>
</div>
<div class="response">
<p style="color:white">
<table class="response">
<form method="POST" autocomplete="off">
<tr>
<td>
Search for a product:
</td>
<td>
<input type="text" id="searchitem" name="searchitem">
</td>
<td>
<input type="submit" value="Search!"/>
</td>
</tr>
</table>
</p>
</form>
</div>
<br />
<div class="searchheader" style="color:white">
<table>
<tr>
<td style="width:200px " >
<b>Product Name</b>
</td>
<td style="width:200px " >
<b>Product Type</b>
</td>
<td style="width:450px " >
<b>Description</b>
</td>
<td style="width:110px " >
<b>Price (in USD)</b>
</td>
</tr>
<?php
if (isset($_POST["searchitem"])) {
$q = "Select * from products where product_name like '".$_POST["searchitem"]."%'";
if (isset($_GET['debug']))
{
if ($_GET['debug']=="true")
{
echo "<pre>".$q."</pre><br /><br />";
}
}
$result = mysqli_query($con,$q);
if (!$result)
{
die("</table></div>".mysqli_error($con));
}
while($row = mysqli_fetch_array($result))
{
echo "<tr><td style=\"width:200px\">".$row[1]."</td><td style=\"width:200px\">".$row[2]."</td><td style=\"width:450px\">".$row[3]."</td><td style=\"width:110px\">".$row[4]."</td></tr>";
}
}
?>
</table>
</div>
<div class="footer">
<p><h4><a href="index.php">Home</a><h4></p>
</div>
<div class="footer">
<p>Riyaz Walikar | @riyazwalikar | [email protected]</p>
</div>
</div> <!-- /container -->
</body>
</html>