Scribd
Upload
9 views5 pages

Employee Search and Display System

The document consists of two files: Employee.php and Employee.html. Employee.php connects to a MySQL database to retrieve and display employee information based on a name input from the user, while Employee.html provides a user interface with a form to input the employee name and uses AJAX to fetch and display the results dynamically. The code includes measures for sanitizing user input to prevent SQL injection and handles database connection errors.

Uploaded by

Anuja Borate
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
9 views5 pages

Employee Search and Display System

The document consists of two files: Employee.php and Employee.html. Employee.php connects to a MySQL database to retrieve and display employee information based on a name input from the user, while Employee.html provides a user interface with a form to input the employee name and uses AJAX to fetch and display the results dynamically. The code includes measures for sanitizing user input to prevent SQL injection and handles database connection errors.

Uploaded by

Anuja Borate
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Employee.

php
<?php

// Retrieve the 'txt' parameter from the URL


$name = $_GET['txt'] ?? '';

// Database connection details


$host = "localhost";
$user = "root";
$pass = "";
$db = "employee_db";

// Create a new MySQLi connection


$mysqli = new mysqli($host, $user, $pass, $db);

// Check if connection was successful


if ($mysqli->connect_error) {
die("Database connection error: " . $mysqli->connect_error);
}

// Select the database (optional, as it's already selected in the connection)


$mysqli->select_db($db);

// Check and display the default database


if ($result = $mysqli->query("SELECT DATABASE()")) {
$row = $result->fetch_row();
echo "Default database is: $row[0]<br>";
$result->close();
}
// Sanitize user input to prevent SQL injection
$name = $mysqli->real_escape_string($name);

// Corrected SQL query


$query = "SELECT * FROM employee WHERE emp_name='$name'";

// Execute the query


$result = $mysqli->query($query);

// Check if there are records found


if ($result && $result->num_rows > 0) {
echo "<table border='1'>";
echo "<tr>";
echo "<th>Employee ID</th>";
echo "<th>Employee Name</th>";
echo "<th>Employee Designation</th>";
echo "<th>Employee Salary</th>";
echo "</tr>";

// Fetch and display data


while ($row = $result->fetch_assoc()) {
echo "<tr>";
echo "<td>" . htmlspecialchars($row['emp_id']) . "</td>";
echo "<td>" . htmlspecialchars($row['emp_name']) . "</td>";
echo "<td>" . htmlspecialchars($row['designation']) . "</td>";
echo "<td>" . htmlspecialchars($row['salary']) . "</td>";
echo "</tr>";
}
echo "</table>";

// Free result set


$result->free();
} else {
echo "No records found for the given match.";
}

// Close the database connection


$mysqli->close();

?>
[Link]
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function display() {
var name = [Link]["f1"]["txt"].value; // Get input value

if (name === "") {


[Link]("result").innerHTML = "";
return;
}

var xmlhttp;
if ([Link]) {
xmlhttp = new XMLHttpRequest();
} else {
xmlhttp = new ActiveXObject("[Link]");
}

[Link] = function () {
if ([Link] == 4 && [Link] == 200) {
[Link]("result").innerHTML = [Link]; //
Fixed response display
}
};

[Link]("GET", "[Link]?txt=" + encodeURIComponent(name), true);


[Link]();
}
</script>
</head>
<body>
<form name="f1">
<label for="txt">Enter Employee Name:</label>
<input type="text" name="txt" id="txt" onkeyup="display()" /><br>
</form>
<div id='result'></div>
</body>
</html>

Common questions

Powered by AI

To enhance security, prepared statements and parameterized queries should be used instead of executing raw SQL queries directly. This provides a more robust protection against SQL injection. Additionally, measures such as input validation and use of a web application firewall could be implemented for comprehensive security .

The 'select_db' method specifies which database to use for the queries executed through the connection. Although it's included in the script, it is technically unnecessary in this context because the database is already specified during the initial connection setup with MySQLi .

Using the 'GET' method allows parameters to be passed in the URL, which can be useful for simple requests. However, it exposes query data in the browser's address bar, which could lead to data leakage and limit the amount of data sent due to URL length restrictions; sensitive information and large payloads should be handled with POST requests instead .

The user interface dynamically updates as the user types in the input field by attaching an 'onkeyup' event listener to the input element. This triggers the 'display()' function, which executes an asynchronous XMLHttpRequest to fetch and display the matching employee records in real-time, updating the DOM element with the ID 'result' with the server's response .

The JavaScript function uses XMLHttpRequest to asynchronously send a GET request to 'Employee.php'. It checks the readyState and status to update the web page with the server response only when the request is complete and successful, thus ensuring that the page does not need to refresh to display the data .

Omitting 'real_escape_string' would leave the application vulnerable to SQL injection, where an attacker could manipulate SQL queries by entering malicious input, potentially compromising the entire database by executing unauthorized queries .

The PHP script handles a database connection error by using the 'connect_error' property of the MySQLi object. If a connection error occurs, it outputs a message using 'die()', which stops the script execution and displays the error .

The PHP script uses the 'real_escape_string' method to sanitize the user input, which prevents SQL injection by escaping special characters in the user-supplied input from the URL parameter .

Once the data is retrieved from the database using the SQL query, the PHP script iterates over the result set using 'fetch_assoc()' to format it into an HTML table. It then echoes each row of data within HTML table tags, encoding special characters with 'htmlspecialchars()' to safely display it on the web page .

Currently, the script does not handle non-200 status codes, meaning failures do not provide feedback in the UI. To improve this, the 'onreadystatechange' function should check for non-200 status codes and update the page with an error message to inform the user of issues with the server request .

You might also like