in reply to Undefined Value Error Message

The numerous declarations of the $LastName variable have already been mentioned to you. After resolving the issue that you are overwriting that variable in your while $sth->fetch_array() routine, I look to where the $LastName variable is reposted to the page within a form so that the next call to your cgi script will have a param with the name LastName but I cannot see one.

The problem is that you do not repost a form from which your cgi script can collect the LastName param. If the search form is written from

print header(), start_html; my $page = "E:/companyname/website/htdocs/resources/header_1.htm"; open (PAGE, "$page") || die "Couldn't open $page"; while (<PAGE>) {print;}

then the search will submit an empty paramater. Outside of this there is nowhere that the page you write has a form which includes a $LastName param

I would not suggest adding the param to the links as the search should be properly submitted via POST through a form.

You should also validate your incoming paramaters using the untainting idiom

my $LastName=param('LastName'); # pattern should match sql field requirement if($LastName =~ /^([\w\s]+)$/){ $LastName = $1; }else{ print invalid search request .html } my $reqpage= param('reqpage'); if($reqpage =~ /^(\d+)$/){ $reqpage = $1; }else{ print invalid page request .html }

relying on sticky param here will not (afaik) work as you are not creating a cgi object, only using the class methods. Also with concurrent search requests a sticky param may get confused.

Supply a form where the $LastName paramater is given, for your script to be delivered the param it is expecting.