Question

I have this code – which is trying to get variables from the URL and then do a MYSQL select based on the criteria (except the NULL values). However, I believe I am going somewhere but I don’t know where:

<?php

    include('db.php'); // include your code to connect to DB.
    $tbl_name="mobile"; //your table name

    $model = ($_GET['model'] ? $_GET['model'] : NULL);
    $mins = ($_GET['mins']  ? $_GET['mins']  : NULL);    
    $texts = ($_GET['texts'] ? $_GET['texts'] : NULL); 
    $freegift = ($_GET['free-gift'] ? $_GET['free-gift'] : NULL);
    $network = ($_GET['network']   ? $_GET['network']   : NULL);
    $plan = ($_GET['plan']  ? $_GET['plan']  : NULL);
    $vars = array($model, $mins, $texts, $freegift, $network, $plan);


    foreach($vars as $value) {
        $value = (isset($_GET[$value]) ? $_GET[$value] : NULL);
        unset ($vars[$value]);  //sweeping the NULL ones 
    }
    $where_clause = $vars[0]; //the only remaining value after previous cleanup


    $where = '';
    if (count($whereClauses) > 0) {
        $where = ' WHERE '.implode(' AND ',$whereClauses);
    }
    $sql5 = mysql_query("SELECT * FROM $tbl_name".$where);

This doesn’t work at all. It should work like www.domain.com/page.php?mobile=Samsung&mins=500 – the vars should be used to perform the search.

Answer 1

I think I understand what you want. But your code has too many errors (both semantic and security). Therefore, I suggest the following code:

include 'db.php';
$tbl_name = 'mobile';

$default_list = array('model', 'mins', 'texts', 'free-gift', 'network', 'plan');
$ins_vars = array_intersect_key($_GET, array_flip($default_list));

if(!empty($ins_vars))
{
   foreach($ins_vars as $key => $val)
   {
      $val = mysql_real_escape_string($val);
      $ins_vars[$key] = "{$key}='{$val}'";
   }

   $where_clause = implode(' AND ', $ins_vars);
   $sql5 = mysql_query("SELECT * FROM {$tbl_name} WHERE {$where_clause}");
}

ps. Not tested but should work.