Question

I have table in MySQL where the data are stored like:

table_1 
+-------+-------+  
|field_0|field_1|
+-------+-------+  
| WCON  |  A    |
+-------+-------+
| KROGR |  B    |
+-------+-------+
|       |  C    |
+-------+-------+
| HALL  |  D    |
+-------+-------+
| OZARK |  E    |
+-------+-------+
|       |  F    |
+-------+-------+
| MAR   |  G    |
+-------+-------+
| KROGR |  H    |
+-------+-------+
| MAR   |  I    |
+-------+-------+

there are some field with empty value in field_0.

my code runs in php. there is a dropdown menu where all the field names are put manually and the values in the menu are ” all | WCON | KROGR | HALL | OZARK |MAR “. From the dropdown menu if “MAR” is selected it will show G and I, but when “all” is selected it need to show all values of field_1.

My code is like that

$field_value = "MAR";
$query = "select field_1 from table_1 where field_0 = '$field_value ' ";

but how can I select all values using the $field_value variable ??

Answer 1

Only add the WHERE clause if the $field_value is not ‘all’. Also, make sure you sanitize any user input into a query. Even if it comes from a dropdown, if the value is being passed to the page from another page, users could be able to insert bad values there.

$query = "SELECT field_1 FROM table_1";

if ($field_value != "all")
  $query .= " WHERE field_0 = '". mysql_real_escape_string($field_value) ."'";