Question

I know for example if you KNOW what parameters to expect you can simply use

$_GET['parameter']

in your MYSQL query. What if you expect 4-5 parameters, however maybe NOT all of them are passed? For example, let’s say the user wants to list all the products which have a price more than 20$ and a warranty of 2 years.

The user could have more search options like for example, the product category should be 2 which is for Laptops

now, my question is, should I have many if statements and check for each possible parameter to see if they are set, and if they are then include them in my MYSQL query, or is there a faster way?
thanks in advance

Answer 1

you should try foreach. Something like:

foreach($_GET as $key => $value) {
   switch($key) {
      case "category":
         $str[] = "category = '". mysql_real_escape_string($value) ."'";
         break;
      case "price":
         $str[] = "price > '". mysql_real_escape_string($value) ."'";
         break;
      case "warranty":
         $str[] = "warranty > '". mysql_real_escape_string($value) ."'";
         break;
   }
}
//create the mysql string with
$str_where = "WHERE " . implode('AND', $str);

you can uset he str_where string to filter the products.