Question

I have the following code that returns rows from a database when a form is filled out. The problem is that unless all three fields are filled out (Name, address, type), the code won’t return anything. I want to change the code so that if let’s say only one field is filled out, it will search for only that one field.

I tried this thanks to help from another member but I think I might have implemented it wrong:

if (empty($name)) {
$nameClause='';
} else {
$nameClause="name='".$name."'";
}

…..

<?php
require("db_access.php");

function parseToXML($htmlStr) 
{ 
$xmlStr=str_replace('<','&lt;',$htmlStr); 
$xmlStr=str_replace('>','&gt;',$xmlStr); 
$xmlStr=str_replace('"','&quot;',$xmlStr); 
$xmlStr=str_replace("'",'&#39;',$xmlStr); 
$xmlStr=str_replace("&",'&amp;',$xmlStr); 
return $xmlStr; 
} 

$name=$_POST['name'];
$address=$_POST['address'];
$type=$_POST['type'];



// Opens a connection to a MySQL server
$connection=mysql_connect (localhost, $username, $password);
if (!$connection) {
  die('Not connected : ' . mysql_error());
}

// Set the active MySQL database
$db_selected = mysql_select_db($database, $connection);
if (!$db_selected) {
  die ('Can\'t use db : ' . mysql_error());
}




// Select all the rows in the markers table
$query = sprintf(
   "SELECT * FROM markers WHERE name = '%s' AND address = '%s' AND type = '%s'",
   mysql_real_escape_string($name),
   mysql_real_escape_string($address),
   mysql_real_escape_string($type)
);
$result = mysql_query($query);
if($result == false) {
   die(mysql_error() . "<br />\n$query");
}
if(mysql_num_rows($result) == 0) {
   user_error("No rows returned by:<br />\n$query");
} 

header("Content-type: text/xml");

// Start XML file, echo parent node
echo '<markers>';

// Iterate through the rows, printing XML nodes for each
while ($row = @mysql_fetch_assoc($result)){
  // ADD TO XML DOCUMENT NODE
  echo '<marker ';
  echo 'name="' . parseToXML($row['name']) . '" ';
  echo 'address="' . parseToXML($row['address']) . '" ';
  echo 'type="' . parseToXML($row['type']) . '" ';
  echo 'lat="' . $row['lat'] . '" ';
  echo 'lng="' . $row['lng'] . '" ';
  echo '/>';
}

// End XML file
echo '</markers>';

?>

I REPLACED THIS:

$query = sprintf(
"SELECT * FROM markers WHERE name = '%s' AND address = '%s' AND type = '%s'",
mysql_real_escape_string($name),
mysql_real_escape_string($address),
mysql_real_escape_string($type)
);

WITH THIS:

$query = sprintf(
   "SELECT * FROM markers WHERE name = '%s' AND address = '%s' AND type = '%s'",
   mysql_real_escape_string($name),
   mysql_real_escape_string($address),
   mysql_real_escape_string($type)
);
$result = mysql_query($query);
if($result == false) {
   die(mysql_error() . "<br />\n$query");
}
if(mysql_num_rows($result) == 0) {
   user_error("No rows returned by:<br />\n$query");
} 

Answer 1

Replace the $query = sprintf(...) code with this:

$inputs = array('name', 'address', 'type');
$where  = array();

foreach($inputs as $input)
{
    if(!empty($_POST[$input])) {
        $where[] = "{$input} = '" . mysql_real_escape_string($_POST[$input]) . "'";
    }
}

if ($where) {
    $query = 'SELECT * FROM markers WHERE ' . implode(' AND ', $where);
} else {
    // do something here if name, address and type are all empty 
}