0

Here's my code:

<?php

require(__DIR__ . "/../includes/config.php");

// numerically indexed array of places
$places = [];

// TODO: search database for places matching $_GET["geo"]

if(is_numeric($_GET["geo"]))    
{       
$sql = 'SELECT * from places WHERE postal_code LIKE "'.$_GET["geo"].'%"';

}
else
{
$q = array_map('trim', explode(",", urldecode($_GET["geo"])));
$sql = "SELECT * FROM places WHERE ";
for($c=0, $count =count($q); $c<$count; $c++)
    {
    $sql .= '(place_name LIKE "%'.htmlspecialchars($q[$c]).'%" OR '.(strlen($q[$i]<= 2)?'admin_code1 LIKE "'.htmlspecialchars($q[$c]).'%" OR ': "").'admin_name1 LIKE "'.htmlspecialchars($q[$c]).'%")';
    if($c<$count-1)
        $sql.=" AND ";
    }   
}       
echo $sql;
$places = query($sql);


// output places as JSON (pretty-printed for debugging convenience)
header("Content-type: application/json");
print(json_encode($places, JSON_PRETTY_PRINT));
?>

Note: It used to work fine, but I made a lot of changes to the sql/query stuff to refine results, seems like I broke it.

0

After 2 more hours of fidgetting, and retesting after removing parts of the code to see if it was responsible, I found it. If you look at this line in my code:

    $sql .= '(place_name LIKE "%'.htmlspecialchars($q[$c]).'%" OR '.(strlen($q[$i]<= 2)?'admin_code1 LIKE "'.htmlspecialchars($q[$c]).'%" OR ': "").'admin_name1 LIKE "'.htmlspecialchars($q[$c]).'%")';

You'll see that I've used an undefined $i to index into $q, instead of using $c. This caused it to output html, for some reason.

I've also found that almost all sorts of errors in the SQL commands lead to vague html responses, which seems to be some sort of error response.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .