Question

I’m new to php and I’m having a problem.

I have three drop down menus to sort results, but I want to make it so if they dont choose anything the defaults is a SELECT * FROM restaurant and if only one drop down is selected to only consider that field.

<form id="form" name="vicinity" method="post" action="restaurant-list.php">
   <select class="form-banner" size="1" id="vicinity" name="vicinity">
      <option value=""> Select one </option>
      <option value="Back Bay">Back Bay</option>
      <option value="Beacon Hill">Beacon Hill</option>
      <option value="Chinatown">Chinatown</option>
   </select><br><br>
   <p class="font-2">Search by Cuisines</p>
   <select class="form-banner" size="1" id="cuisine" name="cuisine">
      <option value=""> Select one </option>
      <option value="American">American</option>
      <option value="Chinese">Chinese</option>
      <option value="Indian">Indian</option>
   </select><br><br>
   <p class="font-2">Search by Price</p>
   <select class="form-banner" size="1"  id="price" name="price">
      <option value=""> Select one </option>
      <option value="$">$ - Cheap</option>
      <option value="$$">$$ - Moderate</option>
      <option value="$$$">$$$ - Pricey</option>
   </select><br><br>
   <input type="submit" id="banner-search" value="Search"/>
</form>

the restaurants page (currently only works when all fields are selected) if one is left blank nothing displays.

<?php
require ("db.php");
$vicinity = $_POST["vicinity"];
$cuisine = $_POST["cuisine"];
$price = $_POST["price"];

$query = "SELECT * FROM restaurant WHERE vicinity=\"$vicinity\" AND cuisine=\"$cuisine\" AND price=\"$price\"";
$result = mysql_query($query);
?>

Any help or ideas how can I achieve this.

Answer 1

Sure in your PHP Code do this: (edited to show one step in preventing injection)

<?php
require ("db.php");
$vicinity = mysql_real_escape_string($_POST["vicinity"]);
$cuisine = mysql_real_escape_string($_POST["cuisine"]);
$price = mysql_real_escape_string($_POST["price"]);

$query = "SELECT * FROM restaurant WHERE 1=1 ";
if($vicinity) $query .= "AND vicinity=\"$vicinity\" ";
if($cuisine)  $query .= "AND cuisine=\"$cuisine\" ";
if($price)    $query .= "AND price=\"$price\"";
$result = mysql_query($query);
?>

Putting the 1=1 after the where just makes it so you don’t have to worry about testing to see if you need an AND or not in front of your where statements and it won’t change your query results.