Question

Well not being the best programmer in the land i thought i would ask this question in the hope someone would spot the error or just tell me I am going the wrong way about it.

I have a Flash Builder web site that am trying to create a Search function to search my MYSQL database with and then return the results.

I have included the not null part just in case the user does not type any data in the relevant variable.

But I am getting this ERROR
Reason: Server error MySQL Error – 1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘wells AND sex LIKE female’ at line 1 #0

HERE IS THE CODE

public function searchClients($fname, $lname, $country, $town, $sex) {

$SQLStatment = "SELECT id, fname, lname, sex, country, town, dateofbirth, monthofbirth, yearofbirth FROM $this->tablename";
$WhereClause = "";
$where =" Where ";

if($fname != "NULL") {
            $WhereClause.= 'Fname LIKE '.$fname;
}         

if($lname != "NULL") {
 if($WhereClause != "") 
 {  
            $WhereClause.= ' AND lname LIKE ' .$lname;
 }
 else
 {
        $WhereClause = 'lname LIKE ' .$lname;
 }
}

if($country != "NULL") {     
if($WhereClause != "") 
 {  
            $WhereClause.= ' AND country LIKE ' .$country;
 }
 else 
 {
        $WhereClause = 'country LIKE ' .$country;
 }
}

if($town != "NULL") {
 if($WhereClause != "") 
 {  
            $WhereClause.= ' AND town LIKE ' .$town;
 }
 else
 {
        $WhereClause = 'town LIKE ' .$town;
 }
}    

if($sex != "NULL") {
 if($WhereClause != "")
 {  
            $WhereClause.= ' AND sex LIKE ' .$sex;
 }
 else
 {
        $WhereClause = 'sex LIKE ' .$sex;
 }
}    
$SQLStatment.= $where;
$SQLStatment.= $WhereClause;

    $stmt = mysqli_prepare($this->connection, $SQLStatment);
    $this->throwExceptionOnError();

     mysqli_stmt_execute($stmt);
    $this->throwExceptionOnError();

    $rows = array();

    mysqli_stmt_bind_result($stmt, $row->ID, $row->fname, $row->lname,  $row->sex, $row->country, $row->town, $row->dateofbirth, $row->monthofbirth, $row->yearofbirth);

    while (mysqli_stmt_fetch($stmt)) {
      $row->fname = ucfirst(substr($row->fname,0,1));
      $row->lname = ucfirst($row->lname);
       $row->town = ucfirst($row->town);
      $row->lname = (($row->fname) . " " . ($row->lname));
      $row->yearofbirth = GetAge($row->dateofbirth. '-' .$row->monthofbirth. '-' .$row->yearofbirth);
      $row->Pic_loc = "";
      $row->Pic_loc= "IMAGES/".($row->ID)."/image01.jpg";
      $rows[] = $row;
      $row = new stdClass();
      mysqli_stmt_bind_result($stmt, $row->ID, $row->fname, $row->lname,  $row->sex, $row->country, $row->town, $row->dateofbirth, $row->monthofbirth, $row->yearofbirth);
    }

    mysqli_stmt_free_result($stmt);
    mysqli_close($this->connection);

    return $rows;
}

It looks good to me but does not work, any suggestions?
to pin point nearer in the code that its moaning is

if($town != "NULL") {
 if($WhereClause != "") 
 {  
            $WhereClause.= ' AND town LIKE ' .$town;
 }
 else
 {
        $WhereClause = 'town LIKE ' .$town;
 }
}    

if($sex != "NULL") {
 if($WhereClause != "")
 {  
            $WhereClause.= ' AND sex LIKE ' .$sex;
 }
 else
 {
        $WhereClause = 'sex LIKE ' .$sex;
 }
}    

just find it really odd that it does not moan about the other three if clauses but it does about the last two.

Answer 1

the where clauses should look like:

$WhereClause .= ' AND sex LIKE "' . mysql_escape_string($sex).'"';

You can use prepared statements / PDO to both simplify the code and protect the application from SQL injection