Tech Control SQL query through URL? - GoFuckYourself.com

Publisher Bucks · 11-18-2021, 09:13 PM

Im trying to figure out how to run an sql query via a url with a string appended to it like this:

domain.com/collection.php?keyword=chicken%garlic

That would display a listing of recipes where the ingredients specifically contained both chicken and garlic.

This is what I have in my regular SQL statement in the coding, how would I make it so that the URL controls the SQL query itself?

Quote:

$con=mysqli_connect("localhost","user","pass","dat abase");

$result = mysqli_query($con,"SELECT * FROM Recipe WHERE Ingredient REGEXP '(?=.*chicken)(?=.*garlic)' ORDER BY RAND() LIMIT 10;");

Is this even possible without significantly changing what I already use for the pages SQL query?

The end goal is to be able to randomly list a bunch of specific recipes from the database in their own page, kind of like how sites like TasteofHome and BHG do for their visitors as a 'recipe collection' article.

So in this instance, that url when clicked would display some filler content, with a dynamically generated listing of 10 (or however many I choose) random recipes that contain both chicken and garlic in their ingredients.

As I undertand it, I'll need to put an escape string in the page somewhere to(?)

Any help/pointers would be greatly appreciated.

k0nr4d · 11-18-2021, 11:44 PM

Untested, and assuming your regex is correct.

domain.com/collection.php?keyword=chicken|garlic

$keywords = explode("|",$_GET['keyword']);
foreach($keywords as $i) {
$output[] = "(?=.*".mysqli_real_escape_string($con,$i).")" ;
}
$result = mysqli_query($con,"SELECT * FROM Recipe WHERE Ingredient REGEXP '".implode("",$output)."' ORDER BY RAND() LIMIT 10");

Publisher Bucks · 11-19-2021, 08:10 AM

Quote:

Originally Posted by k0nr4d

Untested, and assuming your regex is correct.

domain.com/collection.php?keyword=chicken|garlic

$keywords = explode("|",$_GET['keyword']);
foreach($keywords as $i) {
$output[] = "(?=.*".mysqli_real_escape_string($con,$i).")" ;
}
$result = mysqli_query($con,"SELECT * FROM Recipe WHERE Ingredient REGEXP '".implode("",$output)."' ORDER BY RAND() LIMIT 10");

Thank you.

That gives me something to work off, its tossing out a few SQL errors but I can get those fixed.

Appreciate the assistance

V_RocKs · 11-19-2021, 04:05 PM

domain.com/collection.php?keyword=chicken%garlic'--; SELECT * from...

fuzebox · 11-19-2021, 04:26 PM

Quote:

Originally Posted by V_RocKs

domain.com/collection.php?keyword=chicken%garlic'--; SELECT * from...

11-18-2021, 11:44 PM	#2
k0nr4d Confirmed User Industry Role: Join Date: Aug 2006 Location: Poland Posts: 9,228	Untested, and assuming your regex is correct. domain.com/collection.php?keyword=chicken\|garlic $keywords = explode("\|",$_GET['keyword']); foreach($keywords as $i) { $output[] = "(?=.".mysqli_real_escape_string($con,$i).")" ; } $result = mysqli_query($con,"SELECT FROM Recipe WHERE Ingredient REGEXP '".implode("",$output)."' ORDER BY RAND() LIMIT 10"); __________________ Mechanical Bunny Media Mechbunny Tube Script \| Mechbunny Webcam Aggregator Script \| Custom Web Development

11-19-2021, 04:05 PM	#4
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,391	domain.com/collection.php?keyword=chicken%garlic'--; SELECT * from...