Question

I’ve made this php code for filtering the results from a mysql database. It works very well, but I’m sure this is not the most efficient way (or proper use of the language) to achieve the desired results. I’m trying my best to get “good” at writing code and would appreciate some feedback on how I could do this better.

$filter = "";

if (isset($_POST['submit']))
{
$aircraft_reg = "";
$prefix = "";
$part_number = "";
$flight_control = "";

if(!empty($_POST['aircraft_reg']))
    {
    $aircraft_reg = "aircraft_reg = '" . $_POST['aircraft_reg'] . "'";
    }
if(!empty($_POST['prefix']))
    {
    $prefix = "prefix = '" . $_POST['prefix'] . "'";
    }
if(!empty($_POST['part_number']))
    {
    $part_number = "part_number = '" . $_POST['part_number'] . "'";
    }
if(!empty($_POST['flight_control']))
    {
    $flight_control = "flight_control = '" . $_POST['flight_control'] . "'";
    }   
if ($aircraft_reg != "" && ($prefix != "" || $part_number != "" || $flight_control != ""))
    {
    $a = " AND ";
    }
else
    {
    $a = "";
    }
if ($prefix != "" && ($part_number != "" || $flight_control != ""))
    {
    $b = " AND ";
    }
else
    {
    $b = "";
    }
if ($part_number != "" && $flight_control != "")
    {
    $c = " AND ";
    }
else
    {
    $c = "";
    }
if ($aircraft_reg != "" || $prefix != "" || $part_number != "" || $flight_control != "")
    {
    $filter = "WHERE " . $aircraft_reg . $a . $prefix . $b . $part_number . $c . $flight_control;
    }
}

    $result = mysql_query("SELECT * FROM installed $filter ORDER BY aircraft_reg , part_number, date_installed ASC");

Answer 1

You only need follow this pattern:

$result = mysql_query("
        SELECT * 
        FROM installed 
        WHERE  
            ".($_POST['aircraft_reg']?"aircraft_reg=" .mysql_real_escape_string($_POST['aircraft_reg']):"1" )." AND     
            ...
        ORDER BY aircraft_reg , part_number, date_installed ASC");

another alternative:

foreach($_POST as $key => $val)
    if($key!="submit" and $val)
        $filters[] = "$key='".mysql_real_escape_string($val)."' ";


$result = mysql_query("
    SELECT * 
    FROM installed 
    ".(isset($filters)?"WHERE ".implode("AND ",$filters):"")."      
    ORDER BY aircraft_reg , part_number, date_installed ASC");