retrieving value from CGI form textbox out of MySQL table

Question

I have this form that looks like so in a cgi file:

print "<FORM NAME='LAYOUTFORM' ACTION='Handler.cgi' METHOD=POST>";
print "<table border='0' align=center>\n";
print "<tr><td>Search by:<SELECT ID='Forms Combo Box1' NAME='what_to_do'><OPTION VALUE='title'>Title</OPTION><OPTION VALUE='description'>Description</OPTION><OPTION   VALUE='author'>Author</OPTION></td>";
print "<td><INPUT ID='SearchArea' TYPE=TEXT NAME='searchbox' VALUE='' SIZE=27 MAXLENGTH=100></td>";
print "<td><INPUT TYPE=SUBMIT NAME='searchbutton' VALUE='Search' ID='Form_Search'></td></tr>";
print "</table>\n";
print "</form>";

Then I have this:

#!/usr/local/bin/perl

use DBI;
use DBD::mysql;
use CGI qw(:standard);

$searchinput = param('searchbox');

print "Content-type: text/html\n\n";

my $dbh = DBI->connect( "DBI:mysql:database", "username", "password" ) or
die( "Could not make connection to database: $DBI::errstr" );

my $sth = $dbh->prepare( q(SELECT * FROM BookStore WHERE bAuthor = $searchinput) ) or 
die( "Cannot prepare statement: ", $dbh->errstr(), "\n" );

my $rc = $sth->execute() or
die( "Cannot execute statement: ", $sth->errstr(), "\n" );

I am getting this error in commandline:

Uknown column '$searchinput' in 'where clause' at Search.cgi line 17.

What I am trying to do is the user would enter a name into the textbox on the main.cgi. Then hit the search button and the search.cgi would retrieve the info of the row that matches in the column of the table.

hwnd · Accepted Answer · 2014-09-13 04:26:32Z

1

Try changing this line:

my $sth = $dbh->prepare( q(SELECT * FROM BookStore WHERE bAuthor = $searchinput) ) or 
die( "Cannot prepare statement: ", $dbh->errstr(), "\n" );

To:

my $query = sprintf ('SELECT * FROM BookStore WHERE bAuthor = %s', 
                     $dbh->quote("$searchinput"));

edited Sep 13, 2014 at 4:26

answered May 11, 2013 at 0:17

hwnd

70.9k4 gold badges100 silver badges135 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Shawn Over a year ago

That worked wonders and perfectly. Thank you very much will mark as answered.

mob Over a year ago

Your first suggestion is a disaster waiting to happen. Always use placeholders for untrusted user input.

Collectives™ on Stack Overflow

retrieving value from CGI form textbox out of MySQL table

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related