Question

What I would like to achieve here is a user selects an operator, e.g. +, >, <, >= etc. and uses this in a Select statement in PHP.

MY HTML code:

                <label for="grade">Grade: </label>
                <select name="operator" id="operator">
                    <option value="">Select one</option>
                    <option value="<">Less than</option>
                    <option value=">">More than</option>
                    <option value="=">Equals to</option>
                </select>
                <input type="text" name="grade" id="grade" size="2" maxlength="2">
                </input>

My PHP code:

    $operator = mysqli_real_escape_string($link, $_GET['operator']);
$grade = mysqli_real_escape_string($link, $_GET['grade']);
if ($grade != '') {
    $where .= " AND grade . '$operator' . '$grade'";
}

What I would like to achieve is ‘AND grade > 3’. ‘3’ could be another number.

How could I change my codes to make PHP accepts it as a proper statement. Pardon my bad explanation here.

Answer 1

You shouldn’t quote the operator:

$where .= " AND grade $operator  '$grade'";

While you have escaped the grade, I would go further and check the operator is one of your expected operators, e.g.

if (($grade!='') && in_array($operator, array('>', '<', '=')))
{
    ....
}