Re: Searching MySQL with PHP

[Roland Bouman]

In this case, i would recommend to tackle this when you are generating your query:


$sql = "select id,description,color from tablename";

$condition = 0;

$fieldname = 'description';
if (isset($_REQUEST[$fieldname])){
$fieldvalue = $_REQUEST[$fieldname];
if ($fieldvalue!=''){
if ($condition==0){
$sql .= ' WHERE ';
} else {
$sql .= ' OR ';
}
$sql .= $fieldname.'= \''.mysql_real_escape_string($fieldvalue).'\'';
$condition++;
}
}
$fieldname = 'color';
if (isset($_REQUEST[$fieldname])){
$fieldvalue = $_REQUEST[$fieldname];
if ($fieldvalue!=''){
if ($condition==0){
$sql .= ' WHERE ';
} else {
$sql .= ' OR ';
}
$sql .= $fieldname.'= \''.mysql_real_escape_string($fieldvalue).'\'';
$condition++;
}
}

of course, we are now repeating a bit of code. It's probably wiser to put that in a function and call the function instead of repeating it all.

You could also solve it in the query, but this could well be a slower executing query:

$sql="select id, description, color from tablename where"
." description = if('".$_REQUEST["description"]."'='',description,'".$_REQUEST["description"]."') or color = if('".$_REQUEST["color"]."'='',color,'".$_REQUEST["color"]."')"
;