half working code

[ankit1122]

i have this code which doesnt work completely...csv file is generated but query string named as $s is not shown...

<?php
$count = 0;
    foreach($_POST as $item)
    {
    $count += (is_array($item)) ? count($item) : 1;
    }
   // echo "Items = $count";

    $db=$_POST["db"];
$skills = explode(",", $_POST["skills"]);
$table = explode(",", $_POST["table"]);
$city = explode(",", $_POST["city"]);
$region = explode(",", $_POST["region"]);
$country = explode(",", $_POST["country"]);

$latitude=$_POST["lat"];
$longitude=$_POST["long"];

$distance=$_POST["dist"];

$latitude*=0.01745;
$longitude=0.01745;
//print_r($skills);

$filename=  strtotime("now").".csv";

/* @var $table type */
$f="SELECT 'first','last','email' UNION";
$s=$f." select first,last,email from $table[0] where skills regexp \"$skills[0]\"";


for($i=1;$i<count($skills);$i++)
{
    $s.=" and skills regexp \"$skills[$i]\"";

    }

    for($i=0;$i<count($region);$i++)
if(!$region[$i]=="")
    {
    $s.=" and region regexp \"$region[$i]\"";

    }

    for($i=0;$i<count($city);$i++)
if(!$city[$i]=="")
    {
    $s.=" and city regexp \"$city[$i]\"";

    }


    for($i=0;$i<count($country);$i++)
if(!$country[$i]=="")
    {
    $s.=" and country regexp \"$country[$i]\"";

    }
    if(!$latitude=="")
   $s.=" and acos(sin($latitude) * sin(Lati) + cos($latitude) * cos(Lati) * cos(Longi - ($longitude))) * 6371 <= $distance";



    $s.="INTO OUTFILE '/var/tmp/$filename'
FIELDS TERMINATED BY ','
LINES TERMINATED BY '\\n';";



    $con=mysqli_connect("localhost","root","cutiepie_100",$db);
    if (mysqli_connect_errno()) 
        {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$abc=mysqli_query($con, $s) or die('cannot show tables');
if($abc)
print_r($s);
echo $filename;
?>

not the $fiename is shown....

[cereal]

Hi, the problem is given by this:

$abc=mysqli_query($con, $s) or die('cannot show tables');

if($abc)
print_r($s);

The function mysqli_query() returns FALSE on wrong queries, then it returns an OBJECT for SELECT, SHOW, DESCRIBE or EXPLAIN queries, and TRUE for other successful queries, like for example an ALTER query:

$sql = "alter table tbname add type varchar(255) null";

So, the IF condition cannot work correctly for your SELECT query, in this case you must use the function is_object():

$abc=mysqli_query($con, $s) or die('cannot show tables');

if(is_object($abc) === TRUE)
print_r($s);

Or mysqli_errno() which returns 0 when no error occurred, an example:

$mysqli = mysqli_connect("localhost", "user", "pwd", "dbase");
$sql = "select * from tbname";
//$sql = "alter table tbname add type varchar(255) null";
$q = mysqli_query($mysqli, $sql);

echo "<pre>";
echo $q === true ? 'true':'false';
echo PHP_EOL;
echo is_object($q) === true ? 'true':'false';
echo PHP_EOL;
echo mysqli_errno($mysqli) == 0 ? 'true':'false';
echo PHP_EOL;
echo mysqli_errno($mysqli);
echo "</pre>";

var_dump($q);

Docs:

• http://php.net/mysqli_query
• http://php.net/manual/en/mysqli.errno.php