Question

So I am trying to involve an if statement in my SQL query in my PHP code. Basically, I want to say “if $var is not 0, add the WHERE clause, but if $var is 0, don’t add it”.

Code below, doesn’t seem to be working. Help is greatly appreciated!

$var = $_GET["var"];

$query = sprintf("SELECT * FROM table ".if($var != 0) { echo "WHERE var = '%s'," }."
  if($var != 0) { mysql_real_escape_string($var) });

$result = mysql_query($query);

Update

I ultimately decided that since I will be using multiple conditions for multiple variables, it was best to do the following:

$var = $_GET["var"];
$string ='';
if ($var != 0) {
  $string = "WHERE var =". $var . " ";
}

$query = sprintf("SELECT * FROM table ". $string.");

$result = mysql_query($query);

Now I can use as many variables as I want and add additional clauses to the SQL statement.

Thanks for the help!!

Answer 1

You can’t have an if expression inside string concatentation. Also, you’re missing the trailing ".

$query = sprintf("SELECT * FROM table ". $var != 0 ? "WHERE var = '%s'" : "");

Also, mysql_real_escape_string() doesn’t take the variable by reference, so the modified string is returned:

if($var != 0) { $var = mysql_real_escape_string($var) });