Question

I’m creating a form that allows the user to search a database for different criteria: location, city, min price, max price, etc.

I have a “base” select statement: SELECT * FROM table.

In the search form there are several text boxes and dropdowns that may or may not have values, depending on what the user wants to search by.

I’m having trouble figuring out how to add WHERE clauses to the sql statement when there may or may not be a value to use for a particular table column (based on the user’s selection).

Thanks for anyone’s help!

Answer 1

In the code where you generate the SQL, check what fields the user has entered and append more checks to the query as you find more input from the user. Quick example in PHP:

$sql = "SELECT * FROM table";
$where_checks = array();

if (isset($_POST['city']))
   $where_checks[] = "city = '{$_POST['city']}'";
if (isset($_POST['location']))
   $where_checks[] = "location = '{$_POST['location']}'";

// Add more stuff here

if (count($where_checks) > 0)
   $sql .= " WHERE " . implode('AND', $where_checks);

// run query

I have intentionally left out sanitation / escaping of the post input to keep the example simple. But you obviously must sanitize the input as well.

Mind the extra space before the WHERE otherwise the query will be broken.