Perl, HTML and MySQL where did my program break? [closed] - mysql

Question

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.
Closed 9 years ago.
Yes I am a student, yes this is an assignment but I just need some help clearing things up. I don't intend for someone to do my homework for me.
So I have a database with 5 books in it with 6 different columns of data. I'm trying to make a perl program that can search that database and return the results in tables. I have to add a way to add them to a cart but that will come later.
The problem with Perl is I have no idea how to check why I'm getting "Internal Server Error." The application makes it to the Perl page so I'm guessing its not that.
#!/usr/bin/perl
use warnings; # allow for warnings to be sent if error's occur
use CGI qw( :standard ); # not a 100% sure what the rest of these mean but they are like #includs in C++, libraries for reference in the code
use DBI;
use DBD::mysql; #database data will come from mysql
my $dbh = DBI->connect( "DBI:mysql:DATABASE NAME", "USERNAME", "PASS REMOVED" ) or
die( "Could not make connection to database: $DBI::errstr" ); # connect to the database with address and pass or return error
$term = $SEARCHTERM[]; #set the search char to $term
$term =~ tr/A-Z/a-z/; #set all characters to lowercase for convenience of search
$sql = "SELECT * FROM Books WHERE Title LIKE %$term% OR Description LIKE %$term% OR Author LIKE %$term%" or die ("$term may have not worked"); #set the query string to search the database
$sth = $dbh->prepare($sql); # prepare to connect to the database
$sth->execute # connect to the database
or die "SQL Error: $DBI::errstr\n"; #or return an error
while (#data = $sth->fetchrow_array) { #while we are grabbing he queried data do a table setup and set variables for table
print "<table width=\"100%\" border=\"0\"> ";
$title = $data[0];
$desc = $data[1];
$author = $data[2];
$pub = $data[3];
$isbn = $data[4];
$photo = $data[5];
print "<tr> <td width=50%>Title: $title</td> <td width=50% rowspan=5>$photo</td></tr><tr><td>Discreption Tags: $desc</td></tr><tr><td></td></tr><tr><td>Author: $author</td></tr><tr><td>ISBN: $isbn</td>
</tr></table> \n";
}
Please help!

Answer 1

Earlier, someone suggested,
my $sql = "
SELECT *
FROM Books
WHERE Title LIKE '%$term%'
OR Description LIKE '%$term%'
OR Author LIKE '%$term%'
";
my $sth = $dbh->prepare($sql);
$sth->execute();
Assuming he's right about your problem, that's incorrect. Consider what happens if someone is search for the title "Foo's Bar"...
Option 1:
my $sql = '
SELECT *
FROM Books
WHERE Title LIKE '.$dbh->quote("%$term%").'
OR Description LIKE '.$dbh->quote("%$term%").'
OR Author LIKE '.$dbh->quote("%$term%").'
';
my $sth = $dbh->prepare($sql);
$sth->execute();
Option 2:
my $sql = '
SELECT *
FROM Books
WHERE Title LIKE ?
OR Description LIKE ?
OR Author LIKE ?
';
my $sth = $dbh->prepare($sql);
$sth->execute("%$term%", "%$term%", "%$term%");

Answer 2

First, may I also HIGHLY recommend adding use strict; to the top of the script and then fix the errors you will get, mostly declaring your variables with my.
Also may I suggest using a modern framework, like say Mojolicious rather than using the very outdated CGI module. They all can run under CGI-like environment and are FAR easier to use!
Finally, you should avoid interpolating variables into SQL strings since its a huge security risk! Try this site for more on the topic: http://bobby-tables.com/

Answer 3

Your select is invalid. Change
$sql = "SELECT * FROM Books WHERE Title LIKE %$term% OR Description LIKE %$term% OR Author LIKE %$term%"
to
$sql = "SELECT * FROM Books WHERE Title LIKE '%$term%' OR Description LIKE '%$term%' OR Author LIKE '%$term%"'
Pattern literals for LIKE should be quoted.