אני לא יודע אם מה שכתבתי לך יעבוד אבל זה בטוח יאבטח לך את הקוד, כדאי מאוד שתקרא על אבטחת מידע המצב שלך לא מזהיר בסוגיה הזו, כדאי שתפנים את מה שביצעתי לך כאן:
PHP קוד:
<?php
/**
* Utility function to return a value from a named array or a specified default
*/
define( "_NOTRIM", 0x0001 );
define( "_ALLOWHTML", 0x0002 );
define( "_ALLOWRAW", 0x0004 );
define( "_NOMAGIC", 0x0008 );
function getParam( &$arr, $name, $def=null, $mask=0 ) {
if (isset( $arr[$name] )) {
if (is_array($arr[$name])) foreach ($arr[$name] as $key=>$element) $result[$key] = cmsGetParam ($arr[$name], $key, $def, $mask);
else {
$result = $arr[$name];
if (!($mask&_NOTRIM)) $result = trim($result);
if (!is_numeric( $result)) {
if (!($mask&_ALLOWHTML)) $result = strip_tags($result);
if (!($mask&_ALLOWRAW)) {
if (is_numeric($def)) $result = intval($result);
}
}
if (!get_magic_quotes_gpc()) {
$return = addslashes( $return );
}
}
return $result;
} else {
return $def;
}
}
$submited = trim( getParam( $_REQUEST, 'submited', 0 ) );
$page = trim( getParam( $_REQUEST, 'page', 0 ) );
$searchTXT = trim( getParam( $_REQUEST, 'searchTXT', 0 ) );
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Untitled</title>
</head>
<body>
<?php
if($submited)
{
function my_err($my_msg)
{
global $failed;
global $err_msg;
if ($failed == FALSE)
{
$failed=TRUE;
$err_msg .="Error(s): <br /> \n";
}
$err_msg .= "$my_msg <br /> \n";
}
$start=mysql_query("SELECT * FROM `news` WHERE `title` LIKE '%".$searchTXT."%' LIMIT ".($page * 10 - 10).", ".$page * 10);
if(mysql_num_rows($start) == 0)
{
my_err('subject not found');
}
else
{
while($info=mysql_fetch_array($start))
{
$info['title'] = str_replace($info['title'], '<b>'.$info['title'].'</b>';
echo '<div>';
echo $info['title'].'<br />';
echo '<a href="'.$info['eauthor'].'">Download now!</a>';
echo '</div>';
echo '<br />';
}
$start=mysql_query("SELECT `id` FROM `news` WHERE `title` LIKE '%".$searchTXT."%'");
$rows=round(mysql_num_rows($start));
for($i = 1; $i <= $rows; $i++);
{
if($i == $page)
{
echo '<a href="search.php?page='.$i.'"><b>'.$i.'</b></a>';
continue;
}
echo '<a href="search.php?page='.$i.'">'.$i.'</a>';
}
echo '</span>';
echo '</body>
</html>';
exit;
}
?>
<?php
if($failed)
echo '<span>'.$err_msg.'</span>';
?>
<form action="search.php" method="get">
<span>Search me:</span><input type="text" name="searchTXT" />
<input type="submit" name="submited" value="TRUE" />
</form>
</body>
</html>