PHP - Form fields that create MYSQL Queries on submit - php

Question

can anyone help me with how can I achieve form fields that create MySQL queries? below are the details
Table name: books
id
user_id
cateory_id
name
1
2
1
Book name 1
1
4
4
Book name 2
and in my HTML view this is how the form looks like
https://imgur.com/Sy0NSf7
The Column field drop down values are the table field names: id, user_id, category_id, name
The Comparison drop down values are: '=', '<', '>', 'contains'
'contains' value is like 'LIKE' this must be change on the backend
and the Value input field is just a text field where you put what you are looking for
This form is dynamic where you can add filter with the radio button condition value of 'or' or 'and'
so my goal is when I click the submit button it will create mysql query with LEFT JOIN?I'm not really sure what I'm supposed to do.
Sample output:
id
user_id
cateory_id
name
1
James
Fiction
Book name 1
1
John
Non-Fiction
Book name 2
below is my code to create mysql query but I think this is wrong because I have a user_id and category_id which I need to append the JOIN
$data = $request->getParsedBody();
$query = "SELECT * FROM books WHERE ";
foreach ($data['column'] as $key => $value) {
if ($data['comparison'][$key] == 'contains')
{
$data['comparison'][$key] = 'LIKE';
$data['value'][$key] = "'%" . $data['value'][$key] . "%'";
}
if ($key <= 0)
{
$query .= "{$value} {$data['comparison'][$key]} '{$data['value'][$key]}'";
}
if ($key > 0) {
if (!$value == "" && !$data['comparison'][$key] == "" && !$data['value'] == "")
{
$query .= " {$data['and_or'][$key-1]} {$value} {$data['comparison'][$key]} '{$data['value'][$key]}'";
}
}
}
$query .= " ORDER BY id DESC";
sorry for my bad english.

Answer 1

As there are only 2 additional tablex we can hardcode them in the query, using a LEFT JOIN so that we will always get any matching data from books.
The following example uses one value for each possible search field. You could construct your query string dynamically using the same logic
<?php
/* We are not prepared prepared to take any risks with sql injection */
if ("$data['comparison1'][$key]" == "AND") { andor[1] = AND } else { andor[1] = "OR"};
if ("$data['comparison2'][$key]" == "AND") { andor[2] = AND } else { andor[2] = "OR"};
if ("$data['comparison3'][$key]" == "AND" ){ andor[3] = AND } else { andor[3] = "OR"};
/* prepare the query using string concatenation with the the values in andor[] */
$query = "SELECT b.id, u.user_id, c.category_id, b.name
FROM books b
LEFT JOIN categories c ON b.id = c.id
LEFT JOIN users u ON b.id = u.id
WHERE
( b.id = COALESCE(:book_id , b.id)"
.andor[1].
"( b.name = COALESCE(:book_name , b.name)"
.andor[2].
"( c.category_id = COALESCE(:category , c.category_id)"
.andor[3].
"( u.user_id = COALESCE(:user_id , u.user_id);";
/* Here you need to prepare the database connecter $dbh */
$host = 'localhost';
$db = 'bookdb';
$user = 'root';
$password = 'S#cr#t1!';
$dsn = "mysql:host=$host;dbname=$db;charset=UTF8";
/* and connect to the database */
try {
$pdo = new PDO($dsn, $user, $password);
if ($pdo) {
echo "Connected to the $db database successfully!";
}
} catch (PDOException $e) {
echo $e->getMessage();
}
/* we prepare the query and load the variables */
$sth = $pdo->prepare($query);
$sth->bindValue(':bookname', "$data['book_id'][$key]");
$sth->bindValue(':book_name', "$data['book_name'][$key]"); ;
$sth->bindValue(':category', "$data['category'][$key]");
$sth->bindValue(':user_id', "$data['user_id'][$key]");
/* here we execute the query and extract the results*/
$sth->execute();
$book_results = $sth->fetchAll();
/* now you can exploit the table $book_results
here we simply print it so that you can check */
print_r( $book_results);
?>