Question

I’m trying to create an Advanced Searching form that sort of look like this ;

http://img805.imageshack.us/img805/7162/30989114.jpg

but what should I write for the query?

I know how to do it if there is only two text box but three, there’s too many probability that user will do.

$query = "SELECT * FROM server WHERE ???";

What should I write for the “???”

I know how to use AND OR in the query but lets say if the user only fill two of the textbox and one empty. If I write something like this ;

$query = "SELECT * FROM server WHERE model='".$model."' and brand='".$brand."' and   SN='".$SN.'" ";

The result will return as empty set. I want the user can choose whether to fill one,two or three of the criteria. If I use OR, the result will not be accurate because if Model have two data with the same name (For example :M4000) but different brand (For example : IBM and SUN). If I use OR and the user wants to search M4000 and SUN, it will display both of the M4000. That’s why it is not accurate.

Answer 1

If the user can decide how many criteria he wants to enter for your search and you want to combine those criteria (only those actually filled by the user), then you must dynamically create your SQL query to include only those fields in the search that are filled by the user. I’ll give you an example.

The code for a simple search form could look like this:

$search_fields = Array(
    // field name => label
   'model'     => 'Model',
   'serialNum' => 'Serial Number',
   'brand'     => 'Brand Name'
);
echo "<form method=\"POST\">";
foreach ($search_fields as $field => $label) {
    echo "$label: <input name=\"search[$field]\"><br>";
}
echo "<input type=\"submit\">";
echo "</form>";

And the code for an actual search like this:

if (isset($_POST['search']) && is_array($_POST['search'])) {
    // escape against SQL injection
    $search = array_filter($_POST['search'], 'mysql_real_escape_string');
    // build SQL
    $search_parts = array();
    foreach ($search as $field => $value) {
        if ($value) {
            $search_parts[] = "$field LIKE '%$value%'";
        }
    }
    $sql = "SELECT * FROM table WHERE " . implode(' AND ', $search_parts);
    // do query here
}
else {
    echo "please enter some search criteria!";
}

In the above code we dynamically build the SQL string to do a search (“AND”) for only the criteria entered.